Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 510
Alerts This Week
Warning Icon 1 510

SUSE Jackson Important Update Security Vulnerabilities 2026-2801-1

suse
Calendar Grey July 9, 2026
Dist Suse Esm H88
Critical security update for SUSE addressing multiple issues in Jackson packages and enhancing application safety.
An update that solves four vulnerabilities and has one security fix can now be installed.

Summary

## This update for jackson-annotations, jackson-bom, jackson-core, jackson- databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues * CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation (bsc#1268897). * CVE-2026-54513: jackson-databind: array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898). * CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899). * CVE-2026-54515: jackson-databindi: case-insensitive deserialization bypasses per-property @JsonIgnoreProperties (bsc#1268902). * jackson-core: document length constraint bypass in blocking, async, and

Topics%20covered

Topics Covered

security advisory SuSE important DNS resolution data deserialization arbitrary class instantiation

References

* bsc#1268603

* bsc#1268897

* bsc#1268898

* bsc#1268899

* bsc#1268902

Cross-

* CVE-2026-54512

* CVE-2026-54513

* CVE-2026-54514

* CVE-2026-54515

CVSS scores:

* CVE-2026-54512 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54512 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54513 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54513 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54513 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54514 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

* CVE-2026-54514 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

* CVE-2026-54515 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:2801-1
Release Date: 2026-07-08T19:05:27Z
Rating: important

Topics%20covered

Topics Covered

security advisory SuSE important DNS resolution data deserialization arbitrary class instantiation

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.