Two security vulnerabilities affecting jackson-databind were identified: CVE-2026-54512 allows arbitrary code execution via a PolymorphicTypeValidator bypass, and CVE-2026-54513 involves a security bypass that also enables arbitrary code execution. These vulnerabilities impact the general-purpose data-binding functionality and tree-model of the Jackson Data Processor, which is widely used in Red Hat Enterprise Linux and dogtag-pki components. Red Hat has released security updates for affected packages in Red Hat Enterprise Linux versions 8, 9, and 10, including AppStream and Extended Update Support variants. The advisories provide updated package versions and instructions for remediation.

Successful exploitation of these vulnerabilities could allow an attacker to bypass security controls and execute arbitrary code on affected systems. This could lead to unauthorized system access or compromise of the affected Red Hat Enterprise Linux systems running vulnerable versions of jackson-databind and dogtag-pki components. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates that fix these vulnerabilities. Users should apply the provided patches and updated packages for jackson-databind and dogtag-pki as detailed in the Red Hat advisories RHSA-2026:40895 and RHSA-2026:43400. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. Applying these updates will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor.