jackson-parent vulnerabilities (Red Hat)

6 vulnerabilities.

• jackson-parent Red Hat jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation CVE-2026-54512 Public exploitFix available 8.1 HighJune 23, 2026
• jackson-parent Red Hat jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) CVE-2026-54513 Fix available 8.1 HighJune 23, 2026
• jackson-parent Red Hat Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled CVE-2025-55752 Public exploitFix available EPSS 64.4% 7.5 HighOctober 27, 2025
• jackson-parent Red Hat jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data CVE-2025-52999 Public exploitFix available 8.7 HighJune 25, 2025
• jackson-parent Red Hat Apache Tomcat: Bypass of rules in Rewrite Valve CVE-2025-31651 Public exploitFix available 9.8 CriticalApril 28, 2025
• jackson-parent Red Hat Deeply nested json in jackson-databind CVE-2020-36518 Public exploitFix available 7.5 HighMarch 11, 2022