SB2026072282 - Fedora 45 update for fasterxml-oss-parent, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-jaxrs-providers, jackson-modules-base, jackson-parent
Published: July 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Incorrect authorization (CVE-ID: CVE-2026-54518)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass write-side authorization restrictions and modify view-restricted creator parameters.
The vulnerability exists due to improper authorization in UnwrappedPropertyHandler.processUnwrappedCreatorProperties() when processing untrusted JSON input for unwrapped creator parameters. A remote attacker can supply crafted JSON data to bypass write-side authorization restrictions and modify view-restricted creator parameters.
This issue occurs when applications use @JsonView as a write-side authorization boundary together with constructor parameters annotated with both @JsonView and @JsonUnwrapped.
2) Incorrect authorization (CVE-ID: CVE-2026-54517)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass access controls and modify view-restricted properties.
The vulnerability exists due to incorrect authorization in BeanDeserializer._deserializeUsingPropertyBased when deserializing property-based input with setterless collection or map creator properties. A remote attacker can send specially crafted JSON input to bypass access controls and modify view-restricted properties.
Only setterless collection or map properties annotated with a restricted @JsonView and processed under an active view are affected.
CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to modify object attributes during deserialization.
The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in POJO deserialization handling when processing crafted JSON input for properties with a renamed getter and an ignored setter. A remote attacker can supply a renamed JSON key to modify object attributes during deserialization.
This issue occurs with private backing fields retained through property inference, allowing the setter's ignore annotation to be bypassed.
CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to modify otherwise ignored object attributes.
The vulnerability exists due to improper control of dynamically determined object attributes in BeanDeserializerBase.createContextual() when processing case-insensitive deserialization with per-property @JsonIgnoreProperties exclusions. A remote attacker can send crafted JSON input to modify otherwise ignored object attributes.
Only applications that enable case-insensitive property matching and rely on per-property @JsonIgnoreProperties to keep a field unwritable are vulnerable.
5) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to instantiate non-allowlisted types.
The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.
The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.
6) Deserialization of Untrusted Data (CVE-ID: CVE-2026-54512)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to instantiate arbitrary classes.
The vulnerability exists due to deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric() and PolymorphicTypeValidator handling when processing polymorphic type identifiers with generic parameters during deserialization. A remote attacker can supply a specially crafted type identifier and JSON data to instantiate arbitrary classes.
Only applications that accept untrusted JSON and have polymorphic typing enabled while relying on a configured PolymorphicTypeValidator allow-list are affected.
Remediation
Install update from vendor's website.