Red Hat has released a security update for Red Hat Lightspeed (formerly Insights) for Runtimes on RHEL 9 addressing four vulnerabilities in jackson-core and jackson-databind libraries. These include CVE-2026-68494 (denial of service due to incomplete fix in async JSON parser), CVE-2026-59888 (@JsonIgnore bypass in Java Records), CVE-2026-50193 (denial of service via deeply nested JSON processing), and CVE-2026-54512 (arbitrary code execution via PolymorphicTypeValidator bypass). The denial of service vulnerability CVE-2026-50193 allows a remote attacker to cause resource exhaustion by sending deeply nested JSON data, leading to service unavailability. Red Hat rates the update as Important and provides guidance to apply the update after ensuring all previous errata are applied. No mitigation other than applying the update is currently recommended.

The vulnerabilities can lead to denial of service conditions by exhausting system resources through malformed or deeply nested JSON data processing, bypass of JSON property ignore annotations, and potential arbitrary code execution via bypassing type validation. This can result in degraded service availability or compromise of the affected system. Red Hat rates the security impact as Important. There are no known exploits in the wild at this time.

Red Hat has released an update for Red Hat Lightspeed (formerly Insights) for Runtimes on RHEL 9 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. No alternative mitigations are currently available or meet Red Hat's criteria for ease of use and applicability. Users should follow Red Hat's official guidance for applying the update as detailed in their advisory.