Skip to content
Fencer Intel
high 8.1

CVE-2026-54513 json

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

published 4mo ago modified 17d ago also EUVD-2026-38593 , GHSA-rmj7-2vxq-3g9f

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Patch / fix

  • maven com.fasterxml.jackson.core:jackson-databind 2.18.8, 2.21.4, 3.1.4
  • maven tools.jackson.core:jackson-databind 3.1.4
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-13
  • Red Hat Red Hat build of Keycloak 26.4 26.4-22, 26.4.14-1
  • Red Hat Red Hat build of Keycloak 26.4.14 openshift-rhel9, rhel9-operator
  • Red Hat Red Hat build of Keycloak 26.6 26.6-11, 26.6.5-1
  • Red Hat Red Hat build of Keycloak 26.6.5 openshift-rhel9, rhel9-operator
  • Red Hat Red Hat Certificate System 10.8 for RHEL-8 8100020260728001635.f9354743
  • Red Hat Red Hat Enterprise Linux 10 0:11.9.0-4.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:11.6.0-2.el10_0
  • Red Hat Red Hat Enterprise Linux 8 8100020260714102233.489197e6
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260720064222.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260720064222.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260720025549.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020260720025549.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260714161755.63b34585
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260714161755.63b34585
  • Red Hat Red Hat Enterprise Linux 9 0:2.21.4-1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.21.4-1.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.21.4-1.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.21.4-1.el9_6
  • Red Hat Red Hat OpenShift Dev Spaces 3.30 1787759145, 1787759723
  • jackson-databind Debian 14 2.18.11-1

debian advisories DEBIAN-CVE-2026-54513

  • eap8-jaxb jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-txw2 jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-xsom jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-log4j jboss enterprise application platform 8.1 2.25.4-1.redhat_00003.1.el10eap
  • eap8-netty jboss enterprise application platform 8.1 4.1.136-1.Final_redhat_00001.1.el10eap
  • eap8-rngom jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-slf4j jboss enterprise application platform 8.1 2.0.18-1.redhat_00001.1.el10eap
  • eap8-neethi jboss enterprise application platform 8.1 3.2.2-1.redhat_00001.1.el10eap

red hat advisories RHSA-2026:70230RHSA-2026:70229RHSA-2026:70228RHSA-2026:48095RHSA-2026:44271RHSA-2026:44065

  • jackson-core SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.22.3
  • jackson-databind SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.28.2
  • jackson-annotations SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.22.3
  • jackson-dataformats-binary SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.21.3
  • jackson-databind SLES for SAP applications 16.0, SLES 16.0 2.18.8-160000.1.1
  • jackson-core SLES for SAP applications 16.0, SLES 16.0 2.18.8-160000.1.1
  • jackson-annotations SLES for SAP applications 16.0, SLES 16.0 2.18.8-160000.1.1

suse advisories SUSE-SU-2026:2801-1SUSE-SU-2026:22504-1

  • jackson-databind openSUSE Leap 16.0 2.18.8-160000.1.1
  • jackson-core openSUSE Leap 16.0 2.18.8-160000.1.1
  • jackson-annotations openSUSE Leap 16.0 2.18.8-160000.1.1
  • jackson-databind openSUSE Tumbleweed 2.18.8-1.1

opensuse advisories openSUSE-SU-2026:21201-1openSUSE-SU-2026:11118-1

  • xsom AlmaLinux 8 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
  • slf4j AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • stax-ex AlmaLinux 8 1.7.7-8.module_el8.5.0+2577+9e95fe00
  • velocity AlmaLinux 8 1.7-24.module_el8.5.0+2577+9e95fe00
  • xalan-j2 AlmaLinux 8 2.7.1-38.module_el8.5.0+2577+9e95fe00
  • javassist AlmaLinux 8 3.18.1-8.module_el8.5.0+2577+9e95fe00
  • xerces-j2 AlmaLinux 8 2.11.0-34.module_el8.5.0+2577+9e95fe00
  • slf4j-jdk14 AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00

almalinux advisories ALSA-2026:43218ALSA-2026:43400ALSA-2026:40895

  • dogtag-pki Rocky Linux 10 11.9.0-4.el10_2.rocky.0.1
  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.10.0+1763+c7c02164
  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.10.0+2052+1b0fb438
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.6.0+843+5a13dac3
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+1763+c7c02164
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+2052+1b0fb438
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+2003+8aeac9cb
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d

rocky linux advisories RLSA-2026:43400RLSA-2026:43218RLSA-2026:40895

Is CVE-2026-54513 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54513 updated cvss 8.1

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

  • Red Hat build of Apache Camel - HawtIO 4 jackson-databind Red Hat build of Apache Camel 4 for Quarkus 3 jackson-databind
    affected: workaround, no fix available
  • Red Hat build of Debezium 3 jackson-databind
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Quarkus jackson-databind Red Hat JBoss Enterprise Application Platform 7 jackson-databind, eap74-els-openjdk8-openshift-rhel8, eap74-els-openjdk11-openshift-rhel8, eap74-els-openjdk17-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Dev Spaces devspaces/multicluster-redirector-rhel9
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 jackson-databind
    affected: workaround, no fix available “Fix deferred”
  • Red Hat AMQ Clients 2026.Q3
    fixed: vendor fix RHSA-2026:69459
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-13, cryostat/jfr-datasource-rhel9 4.2.0-13, cryostat/cryostat-reports-rhel9 4.2.0-13
    fixed: vendor fix RHSA-2026:48151
  • Red Hat AMQ Broker 7.13.6
    fixed: vendor fix RHSA-2026:66545
show 30 more
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat Build of Apache Camel 3.33.2.SP2 jackson-databind 2.21.4.redhat-00002
    fixed: vendor fix RHSA-2026:36839
  • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
    fixed: vendor fix RHSA-2026:54622
  • Red Hat build of Apicurio Registry 3.3.3
    fixed: vendor fix RHSA-2026:76637
  • Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9 26.4-22, rhbk/keycloak-rhel9-operator 26.4-22, rhbk/keycloak-operator-bundle 26.4.14-1
    fixed: vendor fix RHSA-2026:50847
  • Red Hat build of Keycloak 26.4.14
    fixed: vendor fix RHSA-2026:50846
  • Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-11, rhbk/keycloak-rhel9-operator 26.6-11, rhbk/keycloak-operator-bundle 26.6.5-1
    fixed: vendor fix RHSA-2026:50849
  • Red Hat build of Keycloak 26.6.5
    fixed: vendor fix RHSA-2026:50848
  • Red Hat build of Quarkus 3.27.4.SP2 jackson-databind 2.21.4.redhat-00002
    fixed: vendor fix RHSA-2026:36002
  • Red Hat build of Quarkus 3.33.2.SP2 jackson-databind 2.21.4.redhat-00002
    fixed: vendor fix RHSA-2026:36013
  • Red Hat Certificate System 10.8 for RHEL 8 jss 5.9.1-2.module+el8pki+24483+db4528cf, ldapjdk 5.6.0-3.module+el8pki+24228+5326976e, redhat-jss 5.9.1-2.module+el8pki+24483+db4528cf, redhat-pki 11.9.2-4.module+el8pki+24565+7517ad63, redhat-ldapjdk 5.6.0-3.module+el8pki+24228+5326976e, redhat-pki-ca 11.9.2-4.module+el8pki+24565+7517ad63, +19 more
    fixed: vendor fix RHSA-2026:48095
  • Red Hat Data Grid 8.6.2
    fixed: vendor fix RHSA-2026:41951
  • Red Hat Enterprise Linux AppStream (v. 8) slf4j 1.7.25-4.module+el8.10.0+20993+d0f024b0, stax-ex 1.7.7-8.module+el8.10.0+20993+d0f024b0, velocity 1.7-24.module+el8.10.0+20993+d0f024b0, bea-stax 1.2.0-16.module+el8.10.0+20993+d0f024b0, xalan-j2 2.7.1-38.module+el8.10.0+20993+d0f024b0, javassist 3.18.1-8.module+el8.10.0+20993+d0f024b0, +27 more
    fixed: vendor fix RHSA-2026:43218
  • Red Hat Enterprise Linux AppStream (v. 9) jackson-databind 2.21.4-1.el9_8, pki-jackson-databind 2.21.4-1.el9_8
    fixed: vendor fix RHSA-2026:40895
  • Red Hat Enterprise Linux AppStream (v. 10) dogtag-pki 11.9.0-4.el10_2, idm-pki-ca 11.9.0-4.el10_2, idm-pki-kra 11.9.0-4.el10_2, idm-pki-acme 11.9.0-4.el10_2, idm-pki-base 11.9.0-4.el10_2, idm-pki-java 11.9.0-4.el10_2, +3 more
    fixed: vendor fix RHSA-2026:43400
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix RHSA-2026:44062
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix RHSA-2026:44061
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +33 more
    fixed: vendor fix RHSA-2026:44066
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) jackson-databind 2.21.4-1.el9_2, pki-jackson-databind 2.21.4-1.el9_2
    fixed: vendor fix RHSA-2026:44063
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) jackson-databind 2.21.4-1.el9_4, pki-jackson-databind 2.21.4-1.el9_4
    fixed: vendor fix RHSA-2026:44065
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) dogtag-pki 11.6.0-2.el10_0, idm-pki-ca 11.6.0-2.el10_0, idm-pki-kra 11.6.0-2.el10_0, idm-pki-acme 11.6.0-2.el10_0, idm-pki-base 11.6.0-2.el10_0, idm-pki-java 11.6.0-2.el10_0, +3 more
    fixed: vendor fix RHSA-2026:44271
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) jackson-databind 2.21.4-1.el9_6, pki-jackson-databind 2.21.4-1.el9_6
    fixed: vendor fix RHSA-2026:44064
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix RHSA-2026:44062
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix RHSA-2026:44061
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +33 more
    fixed: vendor fix RHSA-2026:44066
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-jaxb 4.0.7-4.redhat_00001.1.el8eap, eap8-txw2 4.0.7-4.redhat_00001.1.el8eap, eap8-xsom 4.0.7-4.redhat_00001.1.el8eap, eap8-rngom 4.0.7-4.redhat_00001.1.el8eap, eap8-log4j 2.25.4-1.redhat_00003.1.el8eap, eap8-neethi 3.2.2-1.redhat_00001.1.el8eap, +101 more
    fixed: vendor fix RHSA-2026:70228
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-jaxb 4.0.7-4.redhat_00001.1.el9eap, eap8-txw2 4.0.7-4.redhat_00001.1.el9eap, eap8-xsom 4.0.7-4.redhat_00001.1.el9eap, eap8-rngom 4.0.7-4.redhat_00001.1.el9eap, eap8-log4j 2.25.4-1.redhat_00003.1.el9eap, eap8-neethi 3.2.2-1.redhat_00001.1.el9eap, +101 more
    fixed: vendor fix RHSA-2026:70229
  • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-jaxb 4.0.7-4.redhat_00001.1.el10eap, eap8-txw2 4.0.7-4.redhat_00001.1.el10eap, eap8-xsom 4.0.7-4.redhat_00001.1.el10eap, eap8-rngom 4.0.7-4.redhat_00001.1.el10eap, eap8-log4j 2.25.4-1.redhat_00003.1.el10eap, eap8-neethi 3.2.2-1.redhat_00001.1.el10eap, +100 more
    fixed: vendor fix RHSA-2026:70230
  • Red Hat JBoss Enterprise Application Platform 8.1.8.GA jackson-databind 2.18.9.redhat-00003
    fixed: vendor fix RHSA-2026:70277
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/openvsx-rhel9 1787759145, devspaces/pluginregistry-rhel9 1787759723
    fixed: vendor fix RHSA-2026:62260

1 more fixed, 22 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4mo ago

Exploit prediction

1.23% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven com.fasterxml.jackson.core:jackson-databind
>=2.10.0, <2.18.8
>=2.19.0, <2.21.4
>=3.0.0, <3.1.4
2.18.8
2.21.4
3.1.4
maven tools.jackson.core:jackson-databind
>=3.0.0, <3.1.4
3.1.4

Affected products

  • FasterXML jackson-databind
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
  • Red Hat Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
  • Red Hat Red Hat build of Keycloak 26.4
  • Red Hat Red Hat build of Keycloak 26.4.14
  • Red Hat Red Hat build of Keycloak 26.6
  • Red Hat Red Hat build of Keycloak 26.6.5
  • Red Hat Red Hat Certificate System 10.8 for RHEL-8
  • Red Hat Red Hat Data Grid 8.6.2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Streams for Apache Kafka 3.2.1
  • Red Hat Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat AMQ Clients
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Lightspeed for Runtimes Operator
  • Red Hat Red Hat Offline Knowledge Portal
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2

Classification

Weakness
  • CWE-184 Incomplete List of Disallowed Inputs
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.