A heap buffer overflow vulnerability (CVE-2026-39919) exists in Ghostscript's JPEG 2000 output adapter. This issue affects various Red Hat Enterprise Linux 8 distributions and related packages. The vulnerability is rated as medium severity. Red Hat has released a security update to address this flaw in Ghostscript version 9.27-18.el8_10. The update mitigates the risk by fixing the heap buffer overflow. No known exploits are reported in the wild at this time.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
* python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
* python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940)
* python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-104045 is a vulnerability in the SSSD component of Red Hat Enterprise Linux 10. It involves a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. A local user can exploit this flaw to cause a denial of service by triggering memory leaks through repeated concurrent map enumeration and invalidation requests, potentially disrupting or crashing the autofs service.
CVE-2026-104046 is a vulnerability in the System Security Services Daemon (SSSD) on Red Hat Enterprise Linux 10. When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. This allows a local attacker to repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. The resulting memory exhaustion can degrade or terminate SSSD authentication services, leading to a denial of service (DoS).
CVE-2026-106062 is a heap-based buffer overflow vulnerability in GIMP's DirectDraw Surface (DDS) loader on Red Hat Enterprise Linux 10. The flaw arises from integer overflow in buffer size calculations using 32-bit arithmetic, leading to insufficient buffer allocation. This can cause heap corruption and potentially allow arbitrary code execution within the GIMP process context. The vulnerability has a high severity score of 7.8 CVSS 3.1.
CVE-2026-101258 is a high severity vulnerability in Ghostscript affecting Red Hat Enterprise Linux 8. It allows an attacker to bypass the -dSAFER sandbox and execute arbitrary shell commands by rendering a crafted PostScript or EPS document. This occurs due to memory corruption combined with disabling of internal path access controls at runtime. Exploitation can compromise confidentiality, integrity, and availability of data accessible to the Ghostscript process. Red Hat has released security updates addressing this issue in Ghostscript packages for RHEL 8.
CVE-2026-106063 is a heap-based buffer overflow vulnerability in the GIMP DICOM export plug-in on Red Hat Enterprise Linux 10. The flaw occurs when exporting images with extremely large dimensions, causing an integer overflow during buffer allocation. This leads to an undersized buffer being written with more data than it can hold. The vulnerability has a CVSS score of 6.3, indicating medium severity, and impacts integrity and availability. No explicit affected versions or patch information are provided in the available data.
A vulnerability in SSSD on Red Hat Enterprise Linux 10 allows an authenticated user in a trusted domain to bypass Host-Based Access Control (HBAC) rules by exploiting how usernames are compared. The flaw occurs because SSSD strips domain qualifiers and compares only short usernames, enabling users with matching short usernames in trusted domains to gain unauthorized access to protected services or hosts.
CVE-2026-104047 is a medium severity vulnerability in the System Security Services Daemon (SSSD) on Red Hat Enterprise Linux 10. It involves improper sanitization of search inputs when SSSD is configured to use Microsoft Entra ID. This flaw allows a local user to craft lookup requests that manipulate directory query filters, potentially leading to unauthorized disclosure of directory information.
CVE-2026-76061 is a medium severity vulnerability in Red Hat OpenShift Container Platform 4 related to improper link resolution before file access in CRI-O's bind_mount_prefix handling. A malicious container or local attacker can exploit this by using a Container Runtime Interface (CRI) hostPath with an intermediate absolute symlink, potentially causing the bind mount source to resolve outside the intended directory. This may lead to unauthorized file access or privilege escalation on the host system.
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.
CVE-2026-106033 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Red Hat Ansible Automation Platform 2. It arises from improper input validation in the application's redirect route, where the next query parameter is assigned directly to location.href without proper checks. This bypasses the platform's built-in URL validation designed to block malicious URI schemes. An attacker can exploit this by crafting a malicious link that executes arbitrary JavaScript in the context of an authenticated user's session.
A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.
Multiple vulnerabilities were identified in libevent versions prior to 2.1.13 and 2.2.2-a affecting various Ubuntu LTS releases from 14.04 through 26.04. These include use-after-free issues leading to denial of service or arbitrary code execution, HTTP request smuggling, out-of-bounds reads, resource exhaustion, and inconsistent HTTP message interpretation that could bypass security restrictions. Fixes have been released and are available through standard system updates or Ubuntu Pro for extended support versions.
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues
- CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows
arbitrary class instantiation (bsc#1268897).
- CVE-2026-54513: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898).
- CVE-2026-54514: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
- CVE-2026-54515: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
(bsc#1268902).
- document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).
Changes for jackson-annotations:
- Update to 2.18.8
* No changes since 2.17.3
Changes for jackson-core:
- Update to 2.18.8
* Changes of 2.18.8
+ #1611: Apply number-length validator on streaming integer path
of async parser
* Changes of 2.18.7
+ #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints
.getMaxDocumentLength()' set
(bsc#1268603, GHSA-2m67-wjpj-xhg9)
+ #1600: Rework 3rd party licenses in jar
+ #1602: 'UTF8DataInputJsonParser' needs to enforce
'StreamReadConstraints.maxNameLength' limit
* Changes of 2.18.6
+ #1512: Number-parsing fix for 'UTF8DataInputJsonParser'
+ #1548: 'StreamReadConstraints.maxDocumentLength' not checked
when creating parser with fixed buffer
+ #1555: Enforce 'StreamReadConstraints.maxNumberLength' for
non-blocking (async) parser
* Changes of 2.18.5
+ #1433: 'JsonParser#getNumberType()' throws
'JsonParseException' when the current token is non-numeric
instead of returning null
+ #1446: Invalid package reference to "java.lang.foreign" from
'com.fasterxml.jackson.core:jackson-core' (from
'FastDoubleParser')
* Changes of 2.18.3
+ #1391: Fix issue where the parser can read back old number
state when parsing later numbers
+ #1397: Jackson changes additional values to infinite in case
of special JSON structures and existing infinite values
+ #1398: Fix issue that feature
COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom
characterEscape is used
* Changes of 2.18.2
+ #1359: Non-surrogate characters being incorrectly combined
when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is
enabled
* Changes of 2.18.1
+ #1353: Use fastdoubleparser 1.0.90
* Changes of 2.18.
+ #223: 'UTF8JsonGenerator' writes supplementary characters as a
surrogate pair: should use 4-byte encoding
+ #1230: Improve performance of 'float' and 'double' parsing
from 'TextBuffer'
+ #1251: 'InternCache' replace synchronized with 'ReentrantLock'
- the cache size limit is no longer strictly enforced for
performance reasons but we should never go far about the limit
+ #1252: 'ThreadLocalBufferManager' replace synchronized with
'ReentrantLock'
+ #1257: Increase InternCache default max size from 100 to 200
+ #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'
+ #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'
classes to prevent use by downstream consumers
+ #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove
from 3.0)
+ #1274: 'NUL'-corrupted keys, values on JSON serialization
+ #1277: Add back Java 22 optimisation in FastDoubleParser
+ #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()
/getDecimalValue()' to avoid String allocation
+ #1305: Make helper methods of 'WriterBasedJsonGenerator'
non-final to allow overriding
+ #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to
limit maximum number of Tokens allowed per document#
+ #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'
decoding proble
Changes for jackson-databind:
- Update to 2.18.8
* Changes of 2.18.8
+ #5950: Improve 'UUIDeserializer' error handling
+ #5951: Improve 'InetSocketAddress' deserialization
(bsc#1268899, CVE-2026-54514)
+ #5969: '@JsonView' by-passed for some "setterless" creator
properties
+ #5971: '@JsonView' by-passed for unwrapped creator parameters
+ #5974: '@JsonIgnore' on Record property ignored with
'PropertyNamingStrategy'
+ #5981: 'BasicPolymorphicTypeValidator' setting
'allowIfSubTypeIsArray()' should validate element type
(bsc#1268898, CVE-2026-54513)
+ #5988: 'PolymorphicTypeValidator' needs to validate generic
type parameters too (bsc#1268897, CVE-2026-54512)
+ #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'
fold case using JVM default locale (Turkish-I bug)
* Changes of 2.18.4
+ #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on
Record property ignored for deserialization
+ #5049: Duplicate creator property "b" (index 0 vs 1) on simple
java record
* Changes of 2.18.3
+ #4444: The 'KeyDeserializer' specified in the class with
'@JsonDeserialize(keyUsing = ...)' is overwritten by the
'KeyDeserializer' specified in the 'ObjectMapper'.
+ #4827: Subclassed Throwable deserialization fails since
v2.18.0 - no creator index for property 'cause'
+ #4844: Fix wrap
CVE-2026-104044 is a vulnerability in the sssd component of Red Hat Enterprise Linux 10. A local attacker can cause a Denial of Service (DoS) by sending a specially crafted PAM request when passkey authentication is enabled. The issue arises from a missing state validation check in passkey Kerberos handling, leading to a NULL pointer dereference and crash of the PAM responder, disrupting authentication services on the host.
A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS).
CVE-2026-104042 is a vulnerability in the sssd component of Red Hat Enterprise Linux 10. A local attacker can trigger a denial of service by sending a crafted PAM request with a zero-length authentication token, causing an out-of-bounds read and crashing the PAM responder. This flaw results from missing input validation when processing the token.
CVE-2026-104041 is a medium severity vulnerability in Red Hat Enterprise Linux 10's SSSD component. An unprivileged local user can cause the Name Service Switch (NSS) responder's negative cache to grow without bound by repeatedly requesting lookups for nonexistent entries. This unchecked cache growth can lead to memory exhaustion, causing a denial of service as the responder becomes unresponsive or terminates.