There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data
    Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed
    InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for
    hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing
    an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-
    level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring
    DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54514)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1947 advisory.

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data     Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV)     is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled     and a type identifier contains generic parameters (i.e. the type ID string contains <),     DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring     before <) against the configured PTV. If the container type is approved, the method parses the full     canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type     without ever validating the nested type arguments against the PTV. The nested type arguments are then     resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type     ID can therefore place a denied class as a generic type parameter of an allowed container -- for example     java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes     the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its     properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV     allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54512)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data     Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4,     BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on     clazz.isArray(), without validating the array's component (element) type against the configured allowlist.
    A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits     EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-     element type IDs are present, it instantiates the component type directly with no further PTV check,     bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54513)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data     Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed     InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for     hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing     an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-     level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring     DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54514)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data     Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-     property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual     deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-     insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from     this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites     the filtered map -- restoring every property _handleByNameInclusion had just removed. The ignored property     becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4. (CVE-2026-54515)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0cb401f9-9f19-11f1-a655-3497f65b111b advisory.

    The Jackson project reports:
    PolymorphicTypeValidator needs to validate generic type               parameters too     BasicPolymorphicTypeValidator setting allowIfSubTypeIsArray()               should validate element type     Add java.lang.Comparable in set of unsafe polymorphic base               types     @JsonView by-passed for @JsonUnwrapped Field/Setter               properties     @JsonView by-passed for some setterless creator               properties     @JsonView by-passed for unwrapped creator parameters     Honor @JsonView for external-type-id (EXTERNAL_PROPERTY)               properties     Renamed @JsonIgnore'd setters can deserialize via private               fields     @JsonIgnore on Record property ignored with               PropertyNamingStrategy     Case-insensitive deserialization may use wrong               @JsonIgnoreProperties     Do not allow DNS resolution when deserializing               InetAddress     Improve InetSocketAddress deserialization     Limit the supported URL schemes for java.nio.file.Path               deserialization     Add StreamReadConstraints number len constraint to               javax.xml.datatype.XMLGregorianCalendar and               javax.xml.datatype.Duration

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21201-1 advisory.

    This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues

    - CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that     allows       arbitrary class instantiation (bsc#1268897).
    - CVE-2026-54513: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator     (bsc#1268898).
    - CVE-2026-54514: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
    - CVE-2026-54515: jackson-databind has case-insensitive deserialization bypasses per-property     @JsonIgnoreProperties       (bsc#1268902).
    - document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).

    Changes for jackson-annotations:

    - Update to 2.18.8
     * No changes since 2.17.3

    Changes for jackson-core:

    - Update to 2.18.8
     * Changes of 2.18.8      + #1611: Apply number-length validator on streaming integer path      of async parser
     * Changes of 2.18.7      + #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints      .getMaxDocumentLength()' set      (bsc#1268603, GHSA-2m67-wjpj-xhg9)      + #1600: Rework 3rd party licenses in jar      + #1602: 'UTF8DataInputJsonParser' needs to enforce      'StreamReadConstraints.maxNameLength' limit
     * Changes of 2.18.6      + #1512: Number-parsing fix for 'UTF8DataInputJsonParser'      + #1548: 'StreamReadConstraints.maxDocumentLength' not checked      when creating parser with fixed buffer      + #1555: Enforce 'StreamReadConstraints.maxNumberLength' for      non-blocking (async) parser
     * Changes of 2.18.5      + #1433: 'JsonParser#getNumberType()' throws      'JsonParseException' when the current token is non-numeric      instead of returning null      + #1446: Invalid package reference to java.lang.foreign from      'com.fasterxml.jackson.core:jackson-core' (from      'FastDoubleParser')
     * Changes of 2.18.3      + #1391: Fix issue where the parser can read back old number      state when parsing later numbers      + #1397: Jackson changes additional values to infinite in case      of special JSON structures and existing infinite values      + #1398: Fix issue that feature      COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom      characterEscape is used
     * Changes of 2.18.2      + #1359: Non-surrogate characters being incorrectly combined      when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is      enabled
     * Changes of 2.18.1      + #1353: Use fastdoubleparser 1.0.90
     * Changes of 2.18.
     + #223: 'UTF8JsonGenerator' writes supplementary characters as a      surrogate pair: should use 4-byte encoding      + #1230: Improve performance of 'float' and 'double' parsing      from 'TextBuffer'      + #1251: 'InternCache' replace synchronized with 'ReentrantLock'
     - the cache size limit is no longer strictly enforced for      performance reasons but we should never go far about the limit      + #1252: 'ThreadLocalBufferManager' replace synchronized with      'ReentrantLock'      + #1257: Increase InternCache default max size from 100 to 200      + #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'      + #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'      classes to prevent use by downstream consumers      + #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove      from 3.0)      + #1274: 'NUL'-corrupted keys, values on JSON serialization      + #1277: Add back Java 22 optimisation in FastDoubleParser      + #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()      /getDecimalValue()' to avoid String allocation      + #1305: Make helper methods of 'WriterBasedJsonGenerator'      non-final to allow overriding      + #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to      limit maximum number of Tokens allowed per document#      + #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'      decoding proble

    Changes for jackson-databind:

    - Update to 2.18.8
     * Changes of 2.18.8      + #5950: Improve 'UUIDeserializer' error handling      + #5951: Improve 'InetSocketAddress' deserialization      (bsc#1268899, CVE-2026-54514)      + #5969: '@JsonView' by-passed for some setterless creator      properties      + #5971: '@JsonView' by-passed for unwrapped creator parameters      + #5974: '@JsonIgnore' on Record property ignored with      'PropertyNamingStrategy'      + #5981: 'BasicPolymorphicTypeValidator' setting      'allowIfSubTypeIsArray()' should validate element type      (bsc#1268898, CVE-2026-54513)      + #5988: 'PolymorphicTypeValidator' needs to validate generic      type parameters too (bsc#1268897, CVE-2026-54512)      + #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'      fold case using JVM default locale (Turkish-I bug)
     * Changes of 2.18.4      + #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on      Record property ignored for deserialization      + #5049: Duplicate creator property b (index 0 vs 1) on simple      java record
     * Changes of 2.18.3      + #4444: The 'KeyDeserializer' specified in the class with      '@JsonDeserialize(keyUsing = ...)' is overwritten by the      'KeyDeserializer' specified in the 'ObjectMapper'.
     + #4827: Subclassed Throwable deserialization fails since      v2.18.0 - no creator index for property 'cause'      + #4844: Fix wrapped array handling wrt 'null' by      'StdDeserializer'      + #4848: Avoid type pollution in 'StringCollectionDeserializer'      + #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not      work with multiple constructors since 2.18      + #4878: When serializing a Map via      Converter(StdDelegatingSerializer), a NullPointerException is      thrown due to missing key serializer      + #4908: Deserialization behavior change with @JsonCreator and      @ConstructorProperties between 2.17 and 2.18      + #4917: 'BigDecimal' deserialization issue when using      '@JsonCreator'      + #4920: Creator properties are ignored on abstract types when      collecting bean properties, breaking AsExternalTypeDeserializer      + #4922: Failing '@JsonMerge' with a custom Map      + #4932: Conversion of 'MissingNode' throws      'JsonProcessingException'
     * Changes of 2.18.2      + #4733: Wrong serialization of Type Ids for certain types of      Enum values      + #4742: Deserialization with Builder, External type id,      '@JsonCreator' failing      + #4777: 'StdValueInstantiator.withArgsCreator' is now set for      creators with no arguments      + #4783 Possibly wrong behavior of @JsonMerge      + #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'      hides actual error      + #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides      '@JsonProperty' values      + #4790: Fix '@JsonAnySetter' issue with setter method      (related to #4639)      + #4807: Improve 'FactoryBasedEnumDeserializer' to work better      with XML module      + #4810: Deserialization using '@JsonCreator' with renamed      property failing (since 2.18)
     * Changes of 2.18.1      + #4508: Deserialized JsonAnySetter field in Kotlin data class      is null      + #4639: @JsonAnySetter on field ignoring unrecognized      properties if they are declared before the last recognized      properties in JSON      + #4718: Should not fail on trying to serialize      'java.time.DateTimeException'      + #4724: Deserialization behavior change with Records,      '@JsonCreator' and '@JsonValue' between 2.17 and 2.18      + #4727: Eclipse having issues due'module-info' class lost on      2.18.0 jars      + #4741: When 'Include.NON_DEFAULT' setting is used on POJO,      empty values are not included in json if default is 'null'      + #4749: Fixed a problem with      'StdDelegatingSerializer#serializeWithType' looking up the      serializer with the wrong argument
     * Changes of 2.18.0      + #562: Allow '@JsonAnySetter' to flow through Creators      + #806: Problem with 'NamingStrategy', creator methods with      implicit names      + #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and      field level '@JsonProperty'      + #3120: Return 'ListIterator' from 'ArrayNode.elements()'      + #3241: 'constructorDetector' seems to invalidate      'defaultSetterInfo' for nullability      + #3439: Java Record '@JsonAnySetter' value is null after      deserialization      + #4085: '@JsonView' does not work on class-level for records      + #4119: Exception when deserialization uses a record with a      constructor property with 'access=READ_ONLY'      + #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't      work for beans with Creator methods      + #4407: 'null' type id handling does not work with      'writeTypePrefix()'      + #4452: '@JsonProperty' not serializing field names properly on      '@JsonCreator' in Record      + #4453: Allow JSON Integer to deserialize into a single-arg      constructor of parameter type 'double'      + #4456: Rework locking in 'DeserializerCache'      + #4458: Rework synchronized block from 'BeanDeserializerBase'      + #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'      method is not called on the serializer      + #4472: Rework synchronized block in 'TypeDeserializerBase'      + #4483: Remove 'final' on method BeanSerializer.serialize()      + #4515: Rewrite Bean Property Introspection logic in Jackson      2.x      + #4545: Unexpected deserialization behavior with      '@JsonCreator', '@JsonProperty' and javac '-parameters'      + #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper      .canSerialize()'      + #4580: Add 'MapperFeature      .SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator      properties' declaration order for sorting      + #4584: Provide extension point for detecting primary      Constructor for Kotlin (and similar) data classes      + #4602: Possible wrong use of _arrayDelegateDeserializer in      BeanDeserializerBase::deserializeFromObjectUsingNonDefault()      + #4617: Record property serialization order not preserved      + #4626: '@JsonIgnore' on Record property ignored for      deserialization, if there is getter override      + #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'      ignored when serializing Records, if there is getter override      + #4634: '@JsonAnySetter' not working when annotated on both      constructor parameter & field      + #4678: Java records don't serialize with 'MapperFeature      .REQUIRE_SETTERS_FOR_GETTERS'      + #4688: Should allow deserializing with no-arg      '@JsonCreator(mode = DELEGATING)'      + #4694: Deserializing 'BigDecimal' with large number of      decimals result in incorrect value      + #4699: Add extra 'writeNumber()' method in 'TokenBuffer'      + #4709: Add 'JacksonCollectors' with 'toArrayNode()'      implementation      + Fix #5962: Case-insensitive deserialization may use wrong      @JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2801-1 advisory.

    This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-     binary, jackson-modules-base, jackson-parent fixes the following issues

    - CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that     allows       arbitrary class instantiation (bsc#1268897).
    - CVE-2026-54513: jackson-databind: array subtype allowlist bypass in BasicPolymorphicTypeValidator     (bsc#1268898).
    - CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution     (bsc#1268899).
    - CVE-2026-54515: jackson-databindi: case-insensitive deserialization bypasses per-property     @JsonIgnoreProperties       (bsc#1268902).
    - jackson-core: document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).

    Changes for jackson-annotations:

    - Update to 2.18.8
     * No changes since 2.17.3

    Changes for jackson-bom:

    - Update to 2.18.8
     * Changes      + #68: Remove 'junit' 4.x dependency from 'jackson-base' 2.18.x      to help junit5 migration      + 'base/pom.xml' now creates '${project.version.underscore}' for      'cleansed' version of '${project.version}'

    Changes for jackson-core:

    - Update to 2.18.8
     * Changes of 2.18.8      + #1611: Apply number-length validator on streaming integer path      of async parser
     * Changes of 2.18.7      + #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints      .getMaxDocumentLength()' set      (bsc#1268603, GHSA-2m67-wjpj-xhg9)      + #1600: Rework 3rd party licenses in jar      + #1602: 'UTF8DataInputJsonParser' needs to enforce      'StreamReadConstraints.maxNameLength' limit
     * Changes of 2.18.6      + #1512: Number-parsing fix for 'UTF8DataInputJsonParser'      + #1548: 'StreamReadConstraints.maxDocumentLength' not checked      when creating parser with fixed buffer      + #1555: Enforce 'StreamReadConstraints.maxNumberLength' for      non-blocking (async) parser
     * Changes of 2.18.5      + #1433: 'JsonParser#getNumberType()' throws      'JsonParseException' when the current token is non-numeric      instead of returning null      + #1446: Invalid package reference to 'java.lang.foreign' from      'com.fasterxml.jackson.core:jackson-core' (from      'FastDoubleParser')
     * Changes of 2.18.3      + #1391: Fix issue where the parser can read back old number      state when parsing later numbers      + #1397: Jackson changes additional values to infinite in case      of special JSON structures and existing infinite values      + #1398: Fix issue that feature      COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom      characterEscape is used
     * Changes of 2.18.2      + #1359: Non-surrogate characters being incorrectly combined      when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is      enabled
     * Changes of 2.18.1      + #1353: Use fastdoubleparser 1.0.90
     * Changes of 2.18.
     + #223: 'UTF8JsonGenerator' writes supplementary characters as a      surrogate pair: should use 4-byte encoding      + #1230: Improve performance of 'float' and 'double' parsing      from 'TextBuffer'      + #1251: 'InternCache' replace synchronized with 'ReentrantLock'
     - the cache size limit is no longer strictly enforced for      performance reasons but we should never go far about the limit      + #1252: 'ThreadLocalBufferManager' replace synchronized with      'ReentrantLock'      + #1257: Increase InternCache default max size from 100 to 200      + #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'      + #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'      classes to prevent use by downstream consumers      + #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove      from 3.0)      + #1274: 'NUL'-corrupted keys, values on JSON serialization      + #1277: Add back Java 22 optimisation in FastDoubleParser      + #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()      /getDecimalValue()' to avoid String allocation      + #1305: Make helper methods of 'WriterBasedJsonGenerator'      non-final to allow overriding      + #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to      limit maximum number of Tokens allowed per document#      + #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'      decoding proble

    Changes for jackson-databind:

    - Update to 2.18.8
     * Changes of 2.18.8      + #5950: Improve 'UUIDeserializer' error handling      + #5951: Improve 'InetSocketAddress' deserialization      (bsc#1268899, CVE-2026-54514)      + #5969: '@JsonView' by-passed for some 'setterless' creator      properties      + #5971: '@JsonView' by-passed for unwrapped creator parameters      + #5974: '@JsonIgnore' on Record property ignored with      'PropertyNamingStrategy'      + #5981: 'BasicPolymorphicTypeValidator' setting      'allowIfSubTypeIsArray()' should validate element type      (bsc#1268898, CVE-2026-54513)      + #5988: 'PolymorphicTypeValidator' needs to validate generic      type parameters too (bsc#1268897, CVE-2026-54512)      + #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'      fold case using JVM default locale (Turkish-I bug)
     * Changes of 2.18.4      + #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on      Record property ignored for deserialization      + #5049: Duplicate creator property 'b' (index 0 vs 1) on simple      java record
     * Changes of 2.18.3      + #4444: The 'KeyDeserializer' specified in the class with      '@JsonDeserialize(keyUsing = ...)' is overwritten by the      'KeyDeserializer' specified in the 'ObjectMapper'.
     + #4827: Subclassed Throwable deserialization fails since      v2.18.0 - no creator index for property 'cause'      + #4844: Fix wrapped array handling wrt 'null' by      'StdDeserializer'      + #4848: Avoid type pollution in 'StringCollectionDeserializer'      + #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not      work with multiple constructors since 2.18      + #4878: When serializing a Map via      Converter(StdDelegatingSerializer), a NullPointerException is      thrown due to missing key serializer      + #4908: Deserialization behavior change with @JsonCreator and      @ConstructorProperties between 2.17 and 2.18      + #4917: 'BigDecimal' deserialization issue when using      '@JsonCreator'      + #4920: Creator properties are ignored on abstract types when      collecting bean properties, breaking AsExternalTypeDeserializer      + #4922: Failing '@JsonMerge' with a custom Map      + #4932: Conversion of 'MissingNode' throws      'JsonProcessingException'
     * Changes of 2.18.2      + #4733: Wrong serialization of Type Ids for certain types of      Enum values      + #4742: Deserialization with Builder, External type id,      '@JsonCreator' failing      + #4777: 'StdValueInstantiator.withArgsCreator' is now set for      creators with no arguments      + #4783 Possibly wrong behavior of @JsonMerge      + #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'      hides actual error      + #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides      '@JsonProperty' values      + #4790: Fix '@JsonAnySetter' issue with 'setter' method      (related to #4639)      + #4807: Improve 'FactoryBasedEnumDeserializer' to work better      with XML module      + #4810: Deserialization using '@JsonCreator' with renamed      property failing (since 2.18)
     * Changes of 2.18.1      + #4508: Deserialized JsonAnySetter field in Kotlin data class      is null      + #4639: @JsonAnySetter on field ignoring unrecognized      properties if they are declared before the last recognized      properties in JSON      + #4718: Should not fail on trying to serialize      'java.time.DateTimeException'      + #4724: Deserialization behavior change with Records,      '@JsonCreator' and '@JsonValue' between 2.17 and 2.18      + #4727: Eclipse having issues due'module-info' class 'lost' on      2.18.0 jars      + #4741: When 'Include.NON_DEFAULT' setting is used on POJO,      empty values are not included in json if default is 'null'      + #4749: Fixed a problem with      'StdDelegatingSerializer#serializeWithType' looking up the      serializer with the wrong argument
     * Changes of 2.18.0      + #562: Allow '@JsonAnySetter' to flow through Creators      + #806: Problem with 'NamingStrategy', creator methods with      implicit names      + #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and      field level '@JsonProperty'      + #3120: Return 'ListIterator' from 'ArrayNode.elements()'      + #3241: 'constructorDetector' seems to invalidate      'defaultSetterInfo' for nullability      + #3439: Java Record '@JsonAnySetter' value is null after      deserialization      + #4085: '@JsonView' does not work on class-level for records      + #4119: Exception when deserialization uses a record with a      constructor property with 'access=READ_ONLY'      + #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't      work for beans with Creator methods      + #4407: 'null' type id handling does not work with      'writeTypePrefix()'      + #4452: '@JsonProperty' not serializing field names properly on      '@JsonCreator' in Record      + #4453: Allow JSON Integer to deserialize into a single-arg      constructor of parameter type 'double'      + #4456: Rework locking in 'DeserializerCache'      + #4458: Rework synchronized block from 'BeanDeserializerBase'      + #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'      method is not called on the serializer      + #4472: Rework synchronized block in 'TypeDeserializerBase'      + #4483: Remove 'final' on method BeanSerializer.serialize()      + #4515: Rewrite Bean Property Introspection logic in Jackson      2.x      + #4545: Unexpected deserialization behavior with      '@JsonCreator', '@JsonProperty' and javac '-parameters'      + #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper      .canSerialize()'      + #4580: Add 'MapperFeature      .SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator      properties' declaration order for sorting      + #4584: Provide extension point for detecting 'primary'      Constructor for Kotlin (and similar) data classes      + #4602: Possible wrong use of _arrayDelegateDeserializer in      BeanDeserializerBase::deserializeFromObjectUsingNonDefault()      + #4617: Record property serialization order not preserved      + #4626: '@JsonIgnore' on Record property ignored for      deserialization, if there is getter override      + #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'      ignored when serializing Records, if there is getter override      + #4634: '@JsonAnySetter' not working when annotated on both      constructor parameter & field      + #4678: Java records don't serialize with 'MapperFeature      .REQUIRE_SETTERS_FOR_GETTERS'      + #4688: Should allow deserializing with no-arg      '@JsonCreator(mode = DELEGATING)'      + #4694: Deserializing 'BigDecimal' with large number of      decimals result in incorrect value      + #4699: Add extra 'writeNumber()' method in 'TokenBuffer'      + #4709: Add 'JacksonCollectors' with 'toArrayNode()'      implementation      + Fix #5962: Case-insensitive deserialization may use wrong      @JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)
    - Fix 'Not fully interpolated version' error with Maven 4

    Changes for jackson-dataformats-binary:

    - Update to 2.18.8
     * Changes of 2.18.8      + #696: (ion) Incomplete number length validation in Ion decoder      (for 'BigDecimal' and/or 'BigInteger')
     * Changes of 2.18.6      + #645: (avro) Remove use of Avro 'Schema.Parser()      .setValidate()' to allow use of Avro core 1.12.1 (2.x)      + #649: (cbor, smile) 'StreamReadConstraints.maxDocumentLength'      not checked when creating parser with fixed buffer      + #651: (smile) Ensure Smile backend supports      'StreamReadConstraints.maxTokenCount'      + #652: (cbor) Ensure CBOR backend supports      + Minor fix to 'ProtobufGenerator._reportEnumError()' helper      method
     * Changes of 2.18.5      + #599: (cbor) Unable to deserialize stringref-enabled CBOR with      ignored properties      + #623: (ion) Upgrade 'ion-java' dep to 1.11.11 (from 1.11.10)
     * Changes of 2.18.4      + #569: (ion) 'IonParser' fails to parse some 'long' values      saying they are out of range when they are not      + #584: (protobuf) Missing 'JsonToken.END_OBJECT' for nested      Protobuf Objects      + (ion) Upgrade 'ion-java' to 1.11.10 (from 1.11.9)
     * Changes of 2.18.3      + #541: (cbor, protobuf, smile) 'SmileParser.getValueAsString()'      FIELD_NAME bug
     * Changes of 2.18.1      + #518: Should not read past end for CBOR string values
     * Changes of 2.18.0      + #167: (avro) Incompatibility with Avro >=1.9.0 (upgrade to      Avro 1.11.3)      + #484: (protobuf) Rework synchronization in 'ProtobufMapper'      + #494: (avro) Avro Schema generation: allow mapping Java Enum      properties to Avro String values      + #508: (avro) Ignore 'specificData' field on serialization      + #509: IonValueMapper.builder() not implemented, does not      register modules
     * (ion) Upgrade 'ion-java' to 1.11.9 (from 1.11.8)      value

    Changes for jackson-modules-base:

    - Upgrade to 2.18.8
     * No changes since 2.18.0
     * Changes of 2.18.0      + #233: (jaxb) Tolerate JAX-RS 2.2 in      jackson-module-jaxb-annotations so that it can be deployed in      Liberty alongside features which use 2.2      + #248: (android-record) jClass annotations and polymorphic      types are ignored when deserializing Android Record fields      + #251: (android-record) Constructor is not recognized when a      record uses both arrays and generic types

    Changes for jackson-parent:

    - Update to 2.18.4
     * Changes of 2.18.4      + Update to latest 'oss-parent' (69)
     * Changes of 2.18.3      + Update to latest 'oss-parent' (68)      + Switch to publishing via Sonatype Central Portal repo
     * Changes of 2.18.2      + Update to latest 'oss-parent' (66); future-proof for Sonatype      Central Portal
     * Changes of 2.18.1      + #15: Add override to downgrade 'moditect-maven-plugin' from      1.2.2 to 1.1.0 to work around Eclipse issues
     * Changes of 2.18      + Update to oss-parent 61 (plugin version updates)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data     Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed     InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for     hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing     an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-     level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring     DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54514)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22504-1 advisory.

    This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues

    - CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that     allows       arbitrary class instantiation (bsc#1268897).
    - CVE-2026-54513: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator     (bsc#1268898).
    - CVE-2026-54514: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
    - CVE-2026-54515: jackson-databind has case-insensitive deserialization bypasses per-property     @JsonIgnoreProperties       (bsc#1268902).
    - document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).

    Changes for jackson-annotations:

    - Update to 2.18.8
     * No changes since 2.17.3

    Changes for jackson-core:

    - Update to 2.18.8
     * Changes of 2.18.8      + #1611: Apply number-length validator on streaming integer path      of async parser
     * Changes of 2.18.7      + #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints      .getMaxDocumentLength()' set      (bsc#1268603, GHSA-2m67-wjpj-xhg9)      + #1600: Rework 3rd party licenses in jar      + #1602: 'UTF8DataInputJsonParser' needs to enforce      'StreamReadConstraints.maxNameLength' limit
     * Changes of 2.18.6      + #1512: Number-parsing fix for 'UTF8DataInputJsonParser'      + #1548: 'StreamReadConstraints.maxDocumentLength' not checked      when creating parser with fixed buffer      + #1555: Enforce 'StreamReadConstraints.maxNumberLength' for      non-blocking (async) parser
     * Changes of 2.18.5      + #1433: 'JsonParser#getNumberType()' throws      'JsonParseException' when the current token is non-numeric      instead of returning null      + #1446: Invalid package reference to java.lang.foreign from      'com.fasterxml.jackson.core:jackson-core' (from      'FastDoubleParser')
     * Changes of 2.18.3      + #1391: Fix issue where the parser can read back old number      state when parsing later numbers      + #1397: Jackson changes additional values to infinite in case      of special JSON structures and existing infinite values      + #1398: Fix issue that feature      COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom      characterEscape is used
     * Changes of 2.18.2      + #1359: Non-surrogate characters being incorrectly combined      when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is      enabled
     * Changes of 2.18.1      + #1353: Use fastdoubleparser 1.0.90
     * Changes of 2.18.
     + #223: 'UTF8JsonGenerator' writes supplementary characters as a      surrogate pair: should use 4-byte encoding      + #1230: Improve performance of 'float' and 'double' parsing      from 'TextBuffer'      + #1251: 'InternCache' replace synchronized with 'ReentrantLock'
     - the cache size limit is no longer strictly enforced for      performance reasons but we should never go far about the limit      + #1252: 'ThreadLocalBufferManager' replace synchronized with      'ReentrantLock'      + #1257: Increase InternCache default max size from 100 to 200      + #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'      + #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'      classes to prevent use by downstream consumers      + #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove      from 3.0)      + #1274: 'NUL'-corrupted keys, values on JSON serialization      + #1277: Add back Java 22 optimisation in FastDoubleParser      + #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()      /getDecimalValue()' to avoid String allocation      + #1305: Make helper methods of 'WriterBasedJsonGenerator'      non-final to allow overriding      + #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to      limit maximum number of Tokens allowed per document#      + #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'      decoding proble

    Changes for jackson-databind:

    - Update to 2.18.8
     * Changes of 2.18.8      + #5950: Improve 'UUIDeserializer' error handling      + #5951: Improve 'InetSocketAddress' deserialization      (bsc#1268899, CVE-2026-54514)      + #5969: '@JsonView' by-passed for some setterless creator      properties      + #5971: '@JsonView' by-passed for unwrapped creator parameters      + #5974: '@JsonIgnore' on Record property ignored with      'PropertyNamingStrategy'      + #5981: 'BasicPolymorphicTypeValidator' setting      'allowIfSubTypeIsArray()' should validate element type      (bsc#1268898, CVE-2026-54513)      + #5988: 'PolymorphicTypeValidator' needs to validate generic      type parameters too (bsc#1268897, CVE-2026-54512)      + #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'      fold case using JVM default locale (Turkish-I bug)
     * Changes of 2.18.4      + #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on      Record property ignored for deserialization      + #5049: Duplicate creator property b (index 0 vs 1) on simple      java record
     * Changes of 2.18.3      + #4444: The 'KeyDeserializer' specified in the class with      '@JsonDeserialize(keyUsing = ...)' is overwritten by the      'KeyDeserializer' specified in the 'ObjectMapper'.
     + #4827: Subclassed Throwable deserialization fails since      v2.18.0 - no creator index for property 'cause'      + #4844: Fix wrapped array handling wrt 'null' by      'StdDeserializer'      + #4848: Avoid type pollution in 'StringCollectionDeserializer'      + #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not      work with multiple constructors since 2.18      + #4878: When serializing a Map via      Converter(StdDelegatingSerializer), a NullPointerException is      thrown due to missing key serializer      + #4908: Deserialization behavior change with @JsonCreator and      @ConstructorProperties between 2.17 and 2.18      + #4917: 'BigDecimal' deserialization issue when using      '@JsonCreator'      + #4920: Creator properties are ignored on abstract types when      collecting bean properties, breaking AsExternalTypeDeserializer      + #4922: Failing '@JsonMerge' with a custom Map      + #4932: Conversion of 'MissingNode' throws      'JsonProcessingException'
     * Changes of 2.18.2      + #4733: Wrong serialization of Type Ids for certain types of      Enum values      + #4742: Deserialization with Builder, External type id,      '@JsonCreator' failing      + #4777: 'StdValueInstantiator.withArgsCreator' is now set for      creators with no arguments      + #4783 Possibly wrong behavior of @JsonMerge      + #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'      hides actual error      + #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides      '@JsonProperty' values      + #4790: Fix '@JsonAnySetter' issue with setter method      (related to #4639)      + #4807: Improve 'FactoryBasedEnumDeserializer' to work better      with XML module      + #4810: Deserialization using '@JsonCreator' with renamed      property failing (since 2.18)
     * Changes of 2.18.1      + #4508: Deserialized JsonAnySetter field in Kotlin data class      is null      + #4639: @JsonAnySetter on field ignoring unrecognized      properties if they are declared before the last recognized      properties in JSON      + #4718: Should not fail on trying to serialize      'java.time.DateTimeException'      + #4724: Deserialization behavior change with Records,      '@JsonCreator' and '@JsonValue' between 2.17 and 2.18      + #4727: Eclipse having issues due'module-info' class lost on      2.18.0 jars      + #4741: When 'Include.NON_DEFAULT' setting is used on POJO,      empty values are not included in json if default is 'null'      + #4749: Fixed a problem with      'StdDelegatingSerializer#serializeWithType' looking up the      serializer with the wrong argument
     * Changes of 2.18.0      + #562: Allow '@JsonAnySetter' to flow through Creators      + #806: Problem with 'NamingStrategy', creator methods with      implicit names      + #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and      field level '@JsonProperty'      + #3120: Return 'ListIterator' from 'ArrayNode.elements()'      + #3241: 'constructorDetector' seems to invalidate      'defaultSetterInfo' for nullability      + #3439: Java Record '@JsonAnySetter' value is null after      deserialization      + #4085: '@JsonView' does not work on class-level for records      + #4119: Exception when deserialization uses a record with a      constructor property with 'access=READ_ONLY'      + #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't      work for beans with Creator methods      + #4407: 'null' type id handling does not work with      'writeTypePrefix()'      + #4452: '@JsonProperty' not serializing field names properly on      '@JsonCreator' in Record      + #4453: Allow JSON Integer to deserialize into a single-arg      constructor of parameter type 'double'      + #4456: Rework locking in 'DeserializerCache'      + #4458: Rework synchronized block from 'BeanDeserializerBase'      + #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'      method is not called on the serializer      + #4472: Rework synchronized block in 'TypeDeserializerBase'      + #4483: Remove 'final' on method BeanSerializer.serialize()      + #4515: Rewrite Bean Property Introspection logic in Jackson      2.x      + #4545: Unexpected deserialization behavior with      '@JsonCreator', '@JsonProperty' and javac '-parameters'      + #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper      .canSerialize()'      + #4580: Add 'MapperFeature      .SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator      properties' declaration order for sorting      + #4584: Provide extension point for detecting primary      Constructor for Kotlin (and similar) data classes      + #4602: Possible wrong use of _arrayDelegateDeserializer in      BeanDeserializerBase::deserializeFromObjectUsingNonDefault()      + #4617: Record property serialization order not preserved      + #4626: '@JsonIgnore' on Record property ignored for      deserialization, if there is getter override      + #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'      ignored when serializing Records, if there is getter override      + #4634: '@JsonAnySetter' not working when annotated on both      constructor parameter & field      + #4678: Java records don't serialize with 'MapperFeature      .REQUIRE_SETTERS_FOR_GETTERS'      + #4688: Should allow deserializing with no-arg      '@JsonCreator(mode = DELEGATING)'      + #4694: Deserializing 'BigDecimal' with large number of      decimals result in incorrect value      + #4699: Add extra 'writeNumber()' method in 'TokenBuffer'      + #4709: Add 'JacksonCollectors' with 'toArrayNode()'      implementation      + Fix #5962: Case-insensitive deserialization may use wrong      @JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
443846	SCA: security update for com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind (GHSA-hgj6-7826-r7m5)	Tenable Cloud Security	SCA Checks	6/24/2026	7/2/2026	medium
443846	SCA: security update for com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind (GHSA-hgj6-7826-r7m5)	Tenable Self-Hosted Container Security	SCA Checks	6/24/2026	7/2/2026	medium
328466	Amazon Linux 2023 : jackson-databind (ALAS2023-2026-1947)	Nessus	Amazon Linux Local Security Checks	7/20/2026	7/20/2026	high
339070	FreeBSD : jackson-databind -- multiple vulnerabilities (0cb401f9-9f19-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	8/24/2026	8/24/2026	high
325046	openSUSE 16: jackson-annotations / jackson-annotations-javadoc / jackson-core / etc (openSUSE-SU-2026:21201-1)	Nessus	SuSE Local Security Checks	7/3/2026	7/3/2026	high
325998	SUSE SLED15: jackson-annotations / jackson-core / jackson-databind / etc (SUSE-SU-2026:2801-1)	Nessus	SuSE Local Security Checks	7/9/2026	7/9/2026	high
322426	Linux Distros Unpatched Vulnerability : CVE-2026-54514	Nessus	Misc.	6/24/2026	9/16/2026	medium
325374	SUSE SLES16: jackson-annotations / jackson-annotations-javadoc / jackson-core / etc (SUSE-SU-2026:22504-1)	Nessus	SuSE Local Security Checks	7/7/2026	7/7/2026	high

Detections

Analytics

Plugins Search

medium

medium

high

high

high

high

medium

high