The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784801122 advisory.

  - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data     Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4,     BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on     clazz.isArray(), without validating the array's component (element) type against the configured allowlist.
    A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits     EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-     element type IDs are present, it instantiates the component type directly with no further PTV check,     bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54513)

  - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data     Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed     InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for     hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing     an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-     level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring     DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54514)

  - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data     Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-     property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual     deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-     insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from     this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites     the filtered map  restoring every property _handleByNameInclusion had just removed. The ignored property     becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4. (CVE-2026-54515)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784801122)

high Nessus Plugin ID 362142

Version 1.2