{
  "affected": [
    {
      "affectedData": [
        {
          "product": "jackson-databind",
          "vendor": "FasterXML",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.15.0, \u003c 2.18.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.0, \u003c 2.21.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4."
    }
  ],
  "id": "CVE-2026-59888",
  "lastModified": "2026-07-15T20:18:23.677",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59888",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-14T17:51:54.891859Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T17:17:15.137",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/FasterXML/jackson-databind/pull/5974"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-915"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.fasterxml.jackson.core:jackson-databind"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.15.0"
            },
            {
              "fixed": "2.18.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.fasterxml.jackson.core:jackson-databind"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.19.0"
            },
            {
              "fixed": "2.21.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "tools.jackson.core:jackson-databind"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59888"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T19:33:06Z",
    "nvd_published_at": "2026-07-14T17:17:15Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nFor Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original implicit name before `_renameUsing()` applies the `PropertyNamingStrategy`. After the rename, `_ignoredPropertyNames` still holds only the pre-rename name, so `_ignorableProps` is built from the stale key. The renamed JSON key passes `IgnorePropertiesUtil.shouldIgnore()` and is assigned to the Record\u0027s constructor parameter, defeating the `@JsonIgnore`.\n\n## Impact\nA Record using a naming strategy that relies on `@JsonIgnore` to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.15-2.18 line: `\u003e= 2.15.0, \u003c 2.18.8` -\u003e fixed in **2.18.8** (backport `c7c6783`)\n- 2.19-2.21 line: `\u003e= 2.19.0, \u003c 2.21.4` -\u003e fixed in **2.21.4**\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4** (#5974, `baa2cdf`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.",
  "id": "GHSA-3pjw-73gf-8qr5",
  "modified": "2026-07-21T19:33:06Z",
  "published": "2026-07-21T19:33:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59888"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/pull/5974"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FasterXML/jackson-databind"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy"
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid met CVE-2026-18963 kan een ongeauthenticeerde externe aanvaller in staat stellen om elke gebruikersaccount over te nemen door een wachtwoordreset af te dwingen. Door deze kwetsbaarheid valt het e-mailverificatieproces bij wachtwoordreset te omzeilen en wachtwoorden van gebruikers te wijzigen.\n\nIn Keycloak zijn daarnaast kwetsbaarheden aanwezig in de Fine-Grained Admin Permissions (FGAP) v2, waardoor bepaalde beheerders met beperkte permissies metadata van verborgen groepen kunnen inzien en details van ongeautoriseerde oudergroepen kunnen blootstellen. Verder kunnen geauthenticeerde aanvallers via een legacy client-initiated account-linking endpoint CSRF-bescherming omzeilen en accounts overnemen. Ook kunnen gedelegeerde beheerders met alleen leesrechten client secrets uitlezen door een fout in de secret rotation. Voor OpenTelemetry Java was er een kwetsbaarheid waarbij het ontbreken van limieten op baggage headers leidde tot onbegrensd geheugen- en CPU-gebruik, wat Denial-of-Service kan veroorzaken. Bij Jackson-libraries is een bypass van de @JsonIgnore annotatie in Java Records vastgesteld, waardoor ongewenste toewijzing aan constructorparameters mogelijk is. Ook zijn er bypasses van @JsonIgnoreProperties, ontbrekende view guards op @JsonUnwrapped en ongeautoriseerde schrijfacties op velden met @JsonView. Oracle Database Server\u0027s Fleet Patching and Provisioning component is eveneens getroffen door een kwetsbaarheid die ongeautoriseerde data toegang of Denial-of-Service kan veroorzaken.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Red Hat heeft updates uitgebracht om deze kwetsbaarheden in Keycloak te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Predictable from Observable State",
        "title": "CWE-341"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Authorization Bypass Through User-Controlled Key",
        "title": "CWE-639"
      },
      {
        "category": "general",
        "text": "Weak Password Recovery Mechanism for Forgotten Password",
        "title": "CWE-640"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Incorrect Authorization",
        "title": "CWE-863"
      },
      {
        "category": "general",
        "text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
        "title": "CWE-915"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://access.redhat.com/errata/RHSA-2026:56519"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://access.redhat.com/errata/RHSA-2026:56520"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://access.redhat.com/errata/RHSA-2026:56523"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://access.redhat.com/errata/RHSA-2026:56524"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.keycloak.org/2026/08/keycloak-2672-released"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Keycloak",
    "tracking": {
      "current_release_date": "2026-08-25T13:39:25.285061Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0326",
      "initial_release_date": "2026-08-25T13:39:25.285061Z",
      "revision_history": [
        {
          "date": "2026-08-25T13:39:25.285061Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "keycloak"
          }
        ],
        "category": "vendor",
        "name": "Keycloak"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Build of Keycloak"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14613",
      "notes": [
        {
          "category": "description",
          "text": "A Moderate severity vulnerability in Keycloak\u0027s admin interface with FGAP v2 enabled allows certain administrators to view metadata of hidden groups due to missing permission checks on role-to-group mappings in the RoleContainerResource component.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-14613 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14613.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-14613"
    },
    {
      "cve": "CVE-2026-15571",
      "cwe": {
        "id": "CWE-341",
        "name": "Predictable from Observable State"
      },
      "notes": [
        {
          "category": "other",
          "text": "Predictable from Observable State",
          "title": "CWE-341"
        },
        {
          "category": "description",
          "text": "A critical vulnerability in Keycloak\u0027s legacy client-initiated account-linking endpoint allows attackers to predict security hashes and forge linking URLs, enabling unauthorized account linking and full account takeover.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-15571 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15571.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-15571"
    },
    {
      "cve": "CVE-2026-15945",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "notes": [
        {
          "category": "other",
          "text": "Authorization Bypass Through User-Controlled Key",
          "title": "CWE-639"
        },
        {
          "category": "description",
          "text": "A vulnerability in Keycloak\u0027s administrative API group search under FGAP v2 allows delegated administrators to bypass access controls and view unauthorized parent group details by exploiting improper filtering during hierarchical group searches.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-15945 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15945.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-15945"
    },
    {
      "cve": "CVE-2026-17048",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in the Keycloak Admin REST API allows delegated administrators with view-only permissions to access client secrets due to improper boundary enforcement during secret rotation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17048 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17048.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17048"
    },
    {
      "cve": "CVE-2026-18963",
      "cwe": {
        "id": "CWE-640",
        "name": "Weak Password Recovery Mechanism for Forgotten Password"
      },
      "notes": [
        {
          "category": "other",
          "text": "Weak Password Recovery Mechanism for Forgotten Password",
          "title": "CWE-640"
        },
        {
          "category": "description",
          "text": "A critical vulnerability in Keycloak versions before 26.7.2, 26.6.6, and 26.4.15 allows unauthenticated attackers to bypass email verification in the reset-credentials flow, enabling full account takeover via improper state validation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18963 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18963.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18963"
    },
    {
      "cve": "CVE-2026-45292",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "OpenTelemetry Java versions prior to 1.62.0 contained a vulnerability in baggage propagation that allowed unbounded memory and CPU consumption via oversized baggage headers, potentially impacting downstream services, fixed by enforcing W3C size limits in 1.62.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-45292 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45292.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-45292"
    },
    {
      "cve": "CVE-2026-59888",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
          "title": "CWE-915"
        },
        {
          "category": "description",
          "text": "Jackson-databind versions 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 had vulnerabilities allowing bypass of @JsonIgnore and @JsonIgnoreProperties on Java Records with PropertyNamingStrategy, fixed in versions 2.18.8, 2.21.4, 3.1.4, and 2.18.9.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-59888 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59888.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-59888"
    },
    {
      "cve": "CVE-2026-59889",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Jackson components, including jackson-databind versions 2.18.0 to 2.18.9 and others, allow bypass of @JsonView and @JsonIgnoreProperties restrictions, enabling unauthorized JSON property writes and privilege escalation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-59889 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59889.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-59889"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat Lightspeed (formerly Insights) for Runtimes on RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "An update is now available for Red Hat Lightspeed (formerly Insights) for Runtimes on RHEL 9.\n\nSecurity fix(es):\n\n* jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)\n* jackson-databind: @JsonIgnore bypass in Java Records (CVE-2026-59888)\n* jackson-databind: Denial of Service via deeply nested JSON processing (CVE-2026-50193)\n* jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:54440",
        "url": "https://access.redhat.com/errata/RHSA-2026:54440"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
        "url": "https://access.redhat.com/security/cve/CVE-2026-50193"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54512"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59888",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59888"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
        "url": "https://access.redhat.com/security/cve/CVE-2026-68494"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54440.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Lightspeed (formerly Insights) for Runtimes security update",
    "tracking": {
      "current_release_date": "2026-08-27T16:00:08+00:00",
      "generator": {
        "date": "2026-08-27T16:00:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:54440",
      "initial_release_date": "2026-08-12T22:01:08+00:00",
      "revision_history": [
        {
          "date": "2026-08-12T22:01:08+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-27T16:00:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
                "product": {
                  "name": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
                  "product_id": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Lightspeed (formerly Insights) for Runtimes"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64",
                "product": {
                  "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64",
                  "product_id": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/runtimes-agent-init-rhel9@sha256%3Aa6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85?arch=amd64\u0026repository_url=registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9\u0026tag=1786378722"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
                "product": {
                  "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
                  "product_id": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/runtimes-agent-init-rhel9@sha256%3A5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3?arch=arm64\u0026repository_url=registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9\u0026tag=1786378722"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
                  "product_id": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/runtimes-agent-init-rhel9@sha256%3Aa2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61?arch=ppc64le\u0026repository_url=registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9\u0026tag=1786378722"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
                "product": {
                  "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
                  "product_id": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/runtimes-agent-init-rhel9@sha256%3A5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27?arch=s390x\u0026repository_url=registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9\u0026tag=1786378722"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
          "product_id": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x"
        },
        "product_reference": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
        "relates_to_product_reference": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64 as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
          "product_id": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64"
        },
        "product_reference": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
        "relates_to_product_reference": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
          "product_id": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le"
        },
        "product_reference": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
        "relates_to_product_reference": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64 as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
          "product_id": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
        },
        "product_reference": "registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64",
        "relates_to_product_reference": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-50193",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-23T22:01:01.154533+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491999"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50193"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491999",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
          "url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
          "url": "https://github.com/FasterXML/jackson-databind/issues/3447"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
        }
      ],
      "release_date": "2026-06-23T21:00:20.444000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T22:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54440"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
    },
    {
      "cve": "CVE-2026-54512",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-06-23T22:01:49.821346+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
          "url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5988"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
        }
      ],
      "release_date": "2026-06-23T20:56:36.646000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T22:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54440"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
    },
    {
      "cve": "CVE-2026-59888",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-07-14T18:02:08.404867+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500096"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an untrusted client could set internal or privileged components from external input, potentially leading to unauthorized modification or disclosure of sensitive data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. This flaw in jackson-databind allows an attacker to bypass the @JsonIgnore annotation when deserializing Java Records that utilize a PropertyNamingStrategy. An untrusted client could exploit this to assign values to internal or privileged Record constructor parameters, potentially leading to unauthorized data modification or disclosure. Red Hat products using affected versions of jackson-databind for deserialization of external input into Java Records with PropertyNamingStrategy are susceptible.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59888"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500096",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500096"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59888",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59888"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59888",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59888"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4",
          "url": "https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d",
          "url": "https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/pull/5974",
          "url": "https://github.com/FasterXML/jackson-databind/pull/5974"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5"
        }
      ],
      "release_date": "2026-07-14T16:44:20.091000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T22:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54440"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records"
    },
    {
      "cve": "CVE-2026-68494",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-04T15:01:53.631865+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511026"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
          "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511026",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
          "url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
          "url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
          "url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1611",
          "url": "https://github.com/FasterXML/jackson-core/pull/1611"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
          "url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
        }
      ],
      "release_date": "2026-08-04T14:39:14.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T22:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54440"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le",
            "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0:registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
    }
  ]
}