Skip to content

bea-stax-api vulnerabilities (AlmaLinux)

23 vulnerabilities.

bea-stax-api AlmaLinux jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service CVE-2026-68498 Fix available 7.5 HighSeptember 24, 2026
bea-stax-api AlmaLinux jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVE-2026-91777 Fix available 7.5 HighSeptember 23, 2026
bea-stax-api AlmaLinux jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth CVE-2026-89425 Fix available 7.5 HighSeptember 23, 2026
bea-stax-api AlmaLinux jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) CVE-2026-54513 Fix available 8.1 HighJune 23, 2026
bea-stax-api AlmaLinux jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data CVE-2025-52999 Public exploitFix available 8.7 HighJune 25, 2025
bea-stax-api AlmaLinux Deeply nested json in jackson-databind CVE-2020-36518 Public exploitFix available 7.5 HighMarch 11, 2022
bea-stax-api AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-10672 Fix available 8.8 HighMarch 18, 2020
bea-stax-api AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-10673 Public exploitFix available 8.8 HighMarch 18, 2020
bea-stax-api AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-9546 Fix available 9.8 CriticalMarch 2, 2020
bea-stax-api AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-9547 Public exploitFix available EPSS 18.4% 9.8 CriticalMarch 2, 2020
bea-stax-api AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-9548 Public exploitFix available EPSS 18.9% 9.8 CriticalMarch 2, 2020
bea-stax-api AlmaLinux Deserialization of Untrusted Data in jackson-databind CVE-2020-8840 Public exploitFix available EPSS 26.6% 9.8 CriticalFebruary 10, 2020
bea-stax-api AlmaLinux Deserialization of Untrusted Data in jackson-databind CVE-2019-20330 Fix available 9.8 CriticalJanuary 3, 2020
bea-stax-api AlmaLinux jackson-databind polymorphic typing issue CVE-2019-17531 Fix available 9.8 CriticalOctober 12, 2019
bea-stax-api AlmaLinux jackson-databind polymorphic typing issue CVE-2019-16943 Fix available 9.8 CriticalOctober 1, 2019
bea-stax-api AlmaLinux Polymorphic Typing in FasterXML jackson-databind CVE-2019-16942 Fix available 9.8 CriticalOctober 1, 2019
bea-stax-api AlmaLinux Polymorphic Typing issue in FasterXML jackson-databind CVE-2019-16335 Fix available 9.8 CriticalSeptember 15, 2019
bea-stax-api AlmaLinux Polymorphic Typing issue in FasterXML jackson-databind CVE-2019-14540 Public exploitFix available EPSS 10.8% 9.8 CriticalSeptember 15, 2019
bea-stax-api AlmaLinux Deserialization of Untrusted Data in FasterXML jackson-databind CVE-2019-12384 Public exploitFix available EPSS 45.2% 5.9 MediumJune 21, 2019
bea-stax-api AlmaLinux Apache Tomcat Open Redirect vulnerability CVE-2018-11784 Public exploitFix available EPSS 97.7% 4.3 MediumOctober 4, 2018
bea-stax-api AlmaLinux Apache Tomcat Race Condition vulnerability CVE-2018-8037 Fix available EPSS 11.2% 5.9 MediumAugust 2, 2018
bea-stax-api AlmaLinux The host name verification missing in Apache Tomcat CVE-2018-8034 Fix available EPSS 21.0% 7.5 HighJuly 24, 2018
bea-stax-api AlmaLinux The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins CVE-2018-8014 Fix available EPSS 20.9% 9.8 CriticalMay 16, 2018