Threats Tagged 'cve-2026-76561'

CVE-2026-68497 is a denial of service vulnerability in the jackson-databind library caused by unbounded numeric parsing. This vulnerability allows an attacker to cause a CPU resource exhaustion, leading to a denial of service condition. The issue affects multiple specific versions of jackson-databind. Red Hat and SUSE have issued security advisories and updates addressing this vulnerability. The vulnerability has a CVSS 3.1 score of 7.5 (medium severity). No known exploits are reported in the wild at this time.

A high-severity vulnerability (CVE-2026-76561) affects the pki-core:10.6 module in Red Hat Enterprise Linux 8. The issue involves the certprofile-import component of Dogtag/PKI, which allows code execution via unsanitized profile content, categorized under CWE-78 (command injection). Red Hat has issued an important security advisory with an update to address this vulnerability. No known exploits in the wild have been reported. The update is available for multiple Red Hat Enterprise Linux 8 variants and architectures.

CVE-2026-76561 is a high-severity vulnerability in Dogtag PKI, part of FreeIPA's certificate authority component in Red Hat Enterprise Linux 10. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID, allowing an authenticated user with CA Administrator privileges to execute arbitrary commands via the ExternalProcessConstraint mechanism. This results in code execution as the pkiuser account. A security update is available to address this issue.