{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-54514: fix InetSocketAddress deserialization to prevent DNS lookup", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1784135237", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1784135237" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/2026/clsa-2026_1784135237.json" } ], "tracking": { "current_release_date": "2026-07-15T17:07:58Z", "generator": { "date": "2026-07-15T17:07:58Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1784135237", "initial_release_date": "2026-07-15T17:07:58Z", "revision_history": [ { "date": "2026-07-15T17:07:58Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "jackson-databind: Fix of CVE-2026-54514" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.6", "product": { "name": "AlmaLinux 9.6", "product_id": "AlmaLinux-9.6", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Rocky Linux 9.6", "product": { "name": "Rocky Linux 9.6", "product_id": "Rocky Linux-9.6", "product_identification_helper": { "cpe": "cpe:2.3:o:resf:rocky_linux:9.6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Rocky Linux" } ], "category": "vendor", "name": "Rocky Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch", "product": { "name": "pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch", "product_id": "pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/pki-jackson-databind@2.19.1-1.el9_6.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch" }, "product_reference": "pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch" }, "product_reference": "pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-54514", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "description", "text": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch", "Rocky Linux-9.6:pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-54514" }, { "category": "external", "summary": "https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4", "url": "https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4" }, { "category": "external", "summary": "https://github.com/FasterXML/jackson-databind/pull/5951", "url": "https://github.com/FasterXML/jackson-databind/pull/5951" }, { "category": "external", "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5" } ], "release_date": "2026-06-23T21:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-15T17:07:20.336667Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1784135237", "product_ids": [ "AlmaLinux-9.6:pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch", "Rocky Linux-9.6:pki-jackson-databind-0:2.19.1-1.el9_6.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1784135237" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }