SUSE-SU-2026:22822-1

Advisory lineage Upstream: 3 Downstream: 0
Published: 18 Jul 2026, 12:45
Last modified:28 Jul 2026, 18:24

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 Jul 2026, 12:45
Published
Vulnerability first disclosed
28 Jul 2026, 18:24
Last Modified
Vulnerability information updated

Description

Security update for jackson-annotations, jackson-core, jackson-databind This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: - CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions (bsc#1268902). - CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to @JsonView restricted fields (bsc#1271440). - CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of @JsonIgnore restrictions (bsc#1271442). Changes for jackson-annotations: - Update to 2.18.9. Changes for jackson-core: - Update to 2.18.9. Changes for jackson-databind: - Update to 2.18.9: * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).

Affected Systems

  • suse•jackson-annotations&distro=SUSE Linux Enterprise Server 16.0

    < 2.18.9-160000.1.1

  • suse•jackson-annotations&distro=SUSE Linux Enterprise Server for SAP applications 16.0

    < 2.18.9-160000.1.1

  • suse•jackson-core&distro=SUSE Linux Enterprise Server 16.0

    < 2.18.9-160000.1.1

  • suse•jackson-core&distro=SUSE Linux Enterprise Server for SAP applications 16.0

    < 2.18.9-160000.1.1

  • suse•jackson-databind&distro=SUSE Linux Enterprise Server 16.0

    < 2.18.9-160000.1.1

  • suse•jackson-databind&distro=SUSE Linux Enterprise Server for SAP applications 16.0

    < 2.18.9-160000.1.1

References (7)