This advisory covers two security vulnerabilities in the jackson-databind component of the Jackson Data Processor, which is used for general-purpose data binding and tree-model processing. The first vulnerability (CVE-2026-54513) is a security bypass that allows arbitrary code execution. The second (CVE-2026-54512) involves arbitrary code execution through a bypass of the PolymorphicTypeValidator. Both vulnerabilities could enable attackers to execute arbitrary code if exploited. Red Hat has released updated packages for Red Hat Enterprise Linux 9 and its variants to address these issues.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on affected systems, potentially leading to full system compromise. The vulnerabilities stem from security bypasses in jackson-databind's handling of polymorphic types, which could be exploited to bypass intended security restrictions.

Red Hat has released updated packages for jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base as part of Red Hat Enterprise Linux 9 updates. Users should apply these official patches as described in the Red Hat advisory RHSA-2026:40895 and the referenced update article (https://access.redhat.com/articles/11258) to remediate these vulnerabilities. Patch status is confirmed as official-fix by Red Hat. No additional mitigation steps are indicated beyond applying the vendor-provided updates.