Threats Tagged 'cve-2026-59888'

Red Hat® AI Inference Server

Red Hat has issued a security update for Red Hat Lightspeed (formerly Insights) for Runtimes on RHEL 9 to address multiple vulnerabilities in the jackson-core and jackson-databind libraries. These vulnerabilities include denial of service via an incomplete async JSON parser fix, denial of service through deeply nested JSON processing, a @JsonIgnore bypass in Java Records, and arbitrary code execution via a PolymorphicTypeValidator bypass. The overall impact is rated as Important by Red Hat. No known exploits have been reported in the wild at this time.

This security update addresses multiple vulnerabilities in jackson-annotations, jackson-core, and jackson-databind libraries. The issues include bypasses of @JsonIgnoreProperties exclusions, unauthorized writes to @JsonView restricted fields due to missing view guards, and bypasses of @JsonIgnore restrictions on Java Records caused by mismatches in property renaming and ignore-filtering. The update advances all three components to version 2.18.9, which includes fixes for these vulnerabilities.

A vulnerability in FasterXML jackson-databind versions from 2.15.0 up to but not including 2.18.8, 2.21.4, and 3.1.4 allows Java Records using a PropertyNamingStrategy to bypass the @JsonIgnore annotation. This occurs because the ignored component is recorded under its original name before the naming strategy renames the JSON key, enabling assignment to the Record constructor parameter. The issue is fixed starting from versions 2.18.8, 2.21.4, and 3.1.4.