Threats Tagged 'cve-2026-83557'

Red Hat has released an important security update for the Red Hat build of Quarkus 3.33.4 that addresses multiple vulnerabilities across various components including jackson-databind, jackson-core, Hibernate Validator, MongoDB Java Driver, RESTEasy, and others. The update fixes issues such as denial of service, path traversal, information disclosure, cross-site scripting, memory leaks, and certificate validation bypass. These vulnerabilities affect the Quarkus 3.33 build and related libraries. The advisory recommends applying this update after ensuring all previous errata are applied.

Red Hat has released an important security update for its build of Quarkus, version 3.27.6, addressing multiple vulnerabilities across various components including jackson-databind, jackson-core, Hibernate Validator, MongoDB Java Driver, RESTEasy, FreeMarker, Qute template engine, MariaDB Connector/J, lz4-java, Micrometer, and Bouncy Castle. These vulnerabilities include denial of service, information disclosure, path traversal, cross-site scripting, memory leaks, and authentication bypass issues. The update consolidates fixes for numerous CVEs, improving the security posture of the affected components.

This security update addresses multiple vulnerabilities in the jackson-annotations, jackson-core, and jackson-databind libraries. The issues include bypasses of number length constraints in asynchronous parsers, unsafe deserialization of java.nio.file.Path URIs, unbounded cache growth, denial of service via unbounded string builder growth, and unsafe polymorphic deserialization allowing arbitrary Comparable types. The update to version 2.18.11 includes fixes that enforce length limits, restrict URI schemes, optimize parsing functions, and prevent unbounded resource consumption.

CVE-2026-83557 is a deserialization vulnerability in FasterXML jackson-databind's default polymorphic type validator. The default validator denies polymorphic resolution only for nine specific unsafe base types but omits java.lang.Comparable, which is implemented by many classes. This omission allows applications using @JsonTypeInfo with Comparable-typed properties and no custom validator to accept type identifiers for any Comparable implementation, potentially enabling unsafe object creation such as java.io.File. The vulnerability affects multiple jackson-databind versions from 2.11.0 up to but excluding 3.2.2 in various ranges. No official patch or remediation guidance is provided in the input data.