RHSA-2026:99846: Important: pki-deps:10.6 security, bug fix, and enhancement update

Published Nov 12, 2026
·
Updated

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.Security Fix(es): com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425) com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498) Bug Fix(es) and Enhancement(s): jackson-modules-base installation error (JIRA:RHEL-295550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

68 affected componentsFixes available
redhat/apache-commons-collections<3.2.2-10.module+el8.1.0+3366+6dfb954c
3.2.2-10.module+el8.1.0+3366+6dfb954c
redhat/apache-commons-lang<2.6-21.module+el8.1.0+3366+6dfb954c
2.6-21.module+el8.1.0+3366+6dfb954c
redhat/apache-commons-net<3.6-3.module+el8.3.0+6805+72837426
3.6-3.module+el8.3.0+6805+72837426
redhat/bea-stax<1.2.0-16.module+el8.1.0+3366+6dfb954c
1.2.0-16.module+el8.1.0+3366+6dfb954c
redhat/fasterxml-oss-parent<75-1.module+el8.4.0+24531+dcbbef34
75-1.module+el8.4.0+24531+dcbbef34
redhat/glassfish-fastinfoset<1.2.13-9.module+el8.1.0+3366+6dfb954c
1.2.13-9.module+el8.1.0+3366+6dfb954c
redhat/glassfish-jaxb<2.2.11-11.module+el8.1.0+3366+6dfb954c
2.2.11-11.module+el8.1.0+3366+6dfb954c
redhat/glassfish-jaxb-api<2.2.12-8.module+el8.1.0+3366+6dfb954c
2.2.12-8.module+el8.1.0+3366+6dfb954c
redhat/jackson-annotations<2.21-1.module+el8.4.0+24531+dcbbef34
2.21-1.module+el8.4.0+24531+dcbbef34
redhat/jackson-bom<2.21.4-1.module+el8.4.0+24531+dcbbef34
2.21.4-1.module+el8.4.0+24531+dcbbef34
redhat/jackson-core<2.21.4-1.module+el8.4.0+25308+2720d8c5.1
2.21.4-1.module+el8.4.0+25308+2720d8c5.1
redhat/jackson-databind<2.21.4-1.module+el8.4.0+24531+dcbbef34
2.21.4-1.module+el8.4.0+24531+dcbbef34
redhat/jackson-jaxrs-providers<2.21.4-1.module+el8.4.0+24531+dcbbef34
2.21.4-1.module+el8.4.0+24531+dcbbef34
redhat/jackson-modules-base<2.21.4-1.module+el8.4.0+25308+2720d8c5.1
2.21.4-1.module+el8.4.0+25308+2720d8c5.1
redhat/jackson-parent<2.21-1.module+el8.4.0+24531+dcbbef34
2.21-1.module+el8.4.0+24531+dcbbef34
redhat/jakarta-commons-httpclient<3.1-28.module+el8.1.0+3366+6dfb954c
3.1-28.module+el8.1.0+3366+6dfb954c
redhat/javassist<3.18.1-8.module+el8.1.0+3366+6dfb954c
3.18.1-8.module+el8.1.0+3366+6dfb954c
redhat/pki-servlet-engine<9.0.30-1.module+el8.4.0+23942+fa6501e9.3
9.0.30-1.module+el8.4.0+23942+fa6501e9.3
redhat/python-nss<1.0.1-10.module+el8.1.0+3366+6dfb954c
1.0.1-10.module+el8.1.0+3366+6dfb954c
redhat/resteasy<3.0.26-6.module+el8.4.0+23399+fc91639f
3.0.26-6.module+el8.4.0+23399+fc91639f
redhat/slf4j<1.7.25-4.module+el8.1.0+3366+6dfb954c
1.7.25-4.module+el8.1.0+3366+6dfb954c
redhat/stax-ex<1.7.7-8.module+el8.2.0+5723+4574fbff
1.7.7-8.module+el8.2.0+5723+4574fbff
redhat/velocity<1.7-24.module+el8.1.0+3366+6dfb954c
1.7-24.module+el8.1.0+3366+6dfb954c
redhat/xalan-j2<2.7.1-38.module+el8.1.0+3366+6dfb954c
2.7.1-38.module+el8.1.0+3366+6dfb954c
redhat/xerces-j2<2.11.0-34.module+el8.1.0+3366+6dfb954c
2.11.0-34.module+el8.1.0+3366+6dfb954c
redhat/xml-commons-apis<1.4.01-25.module+el8.1.0+3366+6dfb954c
1.4.01-25.module+el8.1.0+3366+6dfb954c
redhat/xml-commons-resolver<1.2-26.module+el8.1.0+3366+6dfb954c
1.2-26.module+el8.1.0+3366+6dfb954c
redhat/xmlstreambuffer<1.5.4-8.module+el8.2.0+5723+4574fbff
1.5.4-8.module+el8.2.0+5723+4574fbff
redhat/xsom<0-19.20110809svn.module+el8.1.0+3366+6dfb954c
0-19.20110809svn.module+el8.1.0+3366+6dfb954c
redhat/apache-commons-collections<3.2.2-10.module+el8.1.0+3366+6dfb954c
3.2.2-10.module+el8.1.0+3366+6dfb954c
redhat/apache-commons-lang<2.6-21.module+el8.1.0+3366+6dfb954c
2.6-21.module+el8.1.0+3366+6dfb954c
redhat/apache-commons-net<3.6-3.module+el8.3.0+6805+72837426
3.6-3.module+el8.3.0+6805+72837426
redhat/bea-stax-api<1.2.0-16.module+el8.1.0+3366+6dfb954c
1.2.0-16.module+el8.1.0+3366+6dfb954c
redhat/fasterxml-oss-parent<75-1.module+el8.4.0+24531+dcbbef34
75-1.module+el8.4.0+24531+dcbbef34
redhat/glassfish-fastinfoset<1.2.13-9.module+el8.1.0+3366+6dfb954c
1.2.13-9.module+el8.1.0+3366+6dfb954c
redhat/glassfish-jaxb-api<2.2.12-8.module+el8.1.0+3366+6dfb954c
2.2.12-8.module+el8.1.0+3366+6dfb954c
redhat/glassfish-jaxb-core<2.2.11-11.module+el8.1.0+3366+6dfb954c
2.2.11-11.module+el8.1.0+3366+6dfb954c
redhat/glassfish-jaxb-runtime<2.2.11-11.module+el8.1.0+3366+6dfb954c
2.2.11-11.module+el8.1.0+3366+6dfb954c
redhat/glassfish-jaxb-txw2<2.2.11-11.module+el8.1.0+3366+6dfb954c
2.2.11-11.module+el8.1.0+3366+6dfb954c
redhat/jackson-annotations<2.21-1.module+el8.4.0+24531+dcbbef34
2.21-1.module+el8.4.0+24531+dcbbef34
redhat/jackson-bom<2.21.4-1.module+el8.4.0+24531+dcbbef34
2.21.4-1.module+el8.4.0+24531+dcbbef34
redhat/jackson-core<2.21.4-1.module+el8.4.0+25308+2720d8c5.1
2.21.4-1.module+el8.4.0+25308+2720d8c5.1
redhat/jackson-databind<2.21.4-1.module+el8.4.0+24531+dcbbef34
2.21.4-1.module+el8.4.0+24531+dcbbef34
redhat/jackson-jaxrs-json-provider<2.21.4-1.module+el8.4.0+24531+dcbbef34
2.21.4-1.module+el8.4.0+24531+dcbbef34
redhat/jackson-jaxrs-providers<2.21.4-1.module+el8.4.0+24531+dcbbef34
2.21.4-1.module+el8.4.0+24531+dcbbef34
redhat/jackson-module-jaxb-annotations<2.21.4-1.module+el8.4.0+25308+2720d8c5.1
2.21.4-1.module+el8.4.0+25308+2720d8c5.1
redhat/jackson-modules-base<2.21.4-1.module+el8.4.0+25308+2720d8c5.1
2.21.4-1.module+el8.4.0+25308+2720d8c5.1
redhat/jackson-parent<2.21-1.module+el8.4.0+24531+dcbbef34
2.21-1.module+el8.4.0+24531+dcbbef34
redhat/jakarta-commons-httpclient<3.1-28.module+el8.1.0+3366+6dfb954c
3.1-28.module+el8.1.0+3366+6dfb954c
redhat/javassist<3.18.1-8.module+el8.1.0+3366+6dfb954c
3.18.1-8.module+el8.1.0+3366+6dfb954c
redhat/javassist-javadoc<3.18.1-8.module+el8.1.0+3366+6dfb954c
3.18.1-8.module+el8.1.0+3366+6dfb954c
redhat/pki-servlet<4.0-api-9.0.30-1.module+el8.4.0+23942+fa6501e9.3
4.0-api-9.0.30-1.module+el8.4.0+23942+fa6501e9.3
redhat/pki-servlet-engine<9.0.30-1.module+el8.4.0+23942+fa6501e9.3
9.0.30-1.module+el8.4.0+23942+fa6501e9.3
redhat/python-nss-debugsource<1.0.1-10.module+el8.1.0+3366+6dfb954c
1.0.1-10.module+el8.1.0+3366+6dfb954c
redhat/python-nss-doc<1.0.1-10.module+el8.1.0+3366+6dfb954c
1.0.1-10.module+el8.1.0+3366+6dfb954c
redhat/python3-nss<1.0.1-10.module+el8.1.0+3366+6dfb954c
1.0.1-10.module+el8.1.0+3366+6dfb954c
redhat/python3-nss-debuginfo<1.0.1-10.module+el8.1.0+3366+6dfb954c
1.0.1-10.module+el8.1.0+3366+6dfb954c
redhat/resteasy<3.0.26-6.module+el8.4.0+23399+fc91639f
3.0.26-6.module+el8.4.0+23399+fc91639f
redhat/slf4j<1.7.25-4.module+el8.1.0+3366+6dfb954c
1.7.25-4.module+el8.1.0+3366+6dfb954c
redhat/slf4j-jdk14<1.7.25-4.module+el8.1.0+3366+6dfb954c
1.7.25-4.module+el8.1.0+3366+6dfb954c
redhat/stax-ex<1.7.7-8.module+el8.2.0+5723+4574fbff
1.7.7-8.module+el8.2.0+5723+4574fbff
redhat/velocity<1.7-24.module+el8.1.0+3366+6dfb954c
1.7-24.module+el8.1.0+3366+6dfb954c
redhat/xalan-j2<2.7.1-38.module+el8.1.0+3366+6dfb954c
2.7.1-38.module+el8.1.0+3366+6dfb954c
redhat/xerces-j2<2.11.0-34.module+el8.1.0+3366+6dfb954c
2.11.0-34.module+el8.1.0+3366+6dfb954c
redhat/xml-commons-apis<1.4.01-25.module+el8.1.0+3366+6dfb954c
1.4.01-25.module+el8.1.0+3366+6dfb954c
redhat/xml-commons-resolver<1.2-26.module+el8.1.0+3366+6dfb954c
1.2-26.module+el8.1.0+3366+6dfb954c
redhat/xmlstreambuffer<1.5.4-8.module+el8.2.0+5723+4574fbff
1.5.4-8.module+el8.2.0+5723+4574fbff
redhat/xsom<0-19.20110809svn.module+el8.1.0+3366+6dfb954c
0-19.20110809svn.module+el8.1.0+3366+6dfb954c

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/apache-commons-collections to a version that resolves this vulnerability.

    Fixed in 3.2.2-10.module+el8.1.0+3366+6dfb954c
  2. Upgrade

    Upgrade redhat/apache-commons-lang to a version that resolves this vulnerability.

    Fixed in 2.6-21.module+el8.1.0+3366+6dfb954c
  3. Upgrade

    Upgrade redhat/apache-commons-net to a version that resolves this vulnerability.

    Fixed in 3.6-3.module+el8.3.0+6805+72837426
  4. Upgrade

    Upgrade redhat/bea-stax to a version that resolves this vulnerability.

    Fixed in 1.2.0-16.module+el8.1.0+3366+6dfb954c
  5. Upgrade

    Upgrade redhat/fasterxml-oss-parent to a version that resolves this vulnerability.

    Fixed in 75-1.module+el8.4.0+24531+dcbbef34
  6. Upgrade

    Upgrade redhat/glassfish-fastinfoset to a version that resolves this vulnerability.

    Fixed in 1.2.13-9.module+el8.1.0+3366+6dfb954c
  7. Upgrade

    Upgrade redhat/glassfish-jaxb to a version that resolves this vulnerability.

    Fixed in 2.2.11-11.module+el8.1.0+3366+6dfb954c
  8. Upgrade

    Upgrade redhat/glassfish-jaxb-api to a version that resolves this vulnerability.

    Fixed in 2.2.12-8.module+el8.1.0+3366+6dfb954c
  9. Upgrade

    Upgrade redhat/jackson-annotations to a version that resolves this vulnerability.

    Fixed in 2.21-1.module+el8.4.0+24531+dcbbef34
  10. Upgrade

    Upgrade redhat/jackson-bom to a version that resolves this vulnerability.

    Fixed in 2.21.4-1.module+el8.4.0+24531+dcbbef34
  11. Upgrade

    Upgrade redhat/jackson-core to a version that resolves this vulnerability.

    Fixed in 2.21.4-1.module+el8.4.0+25308+2720d8c5.1
  12. Upgrade

    Upgrade redhat/jackson-databind to a version that resolves this vulnerability.

    Fixed in 2.21.4-1.module+el8.4.0+24531+dcbbef34
  13. Upgrade

    Upgrade redhat/jackson-jaxrs-providers to a version that resolves this vulnerability.

    Fixed in 2.21.4-1.module+el8.4.0+24531+dcbbef34
  14. Upgrade

    Upgrade redhat/jackson-modules-base to a version that resolves this vulnerability.

    Fixed in 2.21.4-1.module+el8.4.0+25308+2720d8c5.1
  15. Upgrade

    Upgrade redhat/jackson-parent to a version that resolves this vulnerability.

    Fixed in 2.21-1.module+el8.4.0+24531+dcbbef34
  16. Upgrade

    Upgrade redhat/jakarta-commons-httpclient to a version that resolves this vulnerability.

    Fixed in 3.1-28.module+el8.1.0+3366+6dfb954c
  17. Upgrade

    Upgrade redhat/javassist to a version that resolves this vulnerability.

    Fixed in 3.18.1-8.module+el8.1.0+3366+6dfb954c
  18. Upgrade

    Upgrade redhat/pki-servlet-engine to a version that resolves this vulnerability.

    Fixed in 9.0.30-1.module+el8.4.0+23942+fa6501e9.3
  19. Upgrade

    Upgrade redhat/python-nss to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.1.0+3366+6dfb954c
  20. Upgrade

    Upgrade redhat/resteasy to a version that resolves this vulnerability.

    Fixed in 3.0.26-6.module+el8.4.0+23399+fc91639f
  21. Upgrade

    Upgrade redhat/slf4j to a version that resolves this vulnerability.

    Fixed in 1.7.25-4.module+el8.1.0+3366+6dfb954c
  22. Upgrade

    Upgrade redhat/stax-ex to a version that resolves this vulnerability.

    Fixed in 1.7.7-8.module+el8.2.0+5723+4574fbff
  23. Upgrade

    Upgrade redhat/velocity to a version that resolves this vulnerability.

    Fixed in 1.7-24.module+el8.1.0+3366+6dfb954c
  24. Upgrade

    Upgrade redhat/xalan-j2 to a version that resolves this vulnerability.

    Fixed in 2.7.1-38.module+el8.1.0+3366+6dfb954c
  25. Upgrade

    Upgrade redhat/xerces-j2 to a version that resolves this vulnerability.

    Fixed in 2.11.0-34.module+el8.1.0+3366+6dfb954c
  26. Upgrade

    Upgrade redhat/xml-commons-apis to a version that resolves this vulnerability.

    Fixed in 1.4.01-25.module+el8.1.0+3366+6dfb954c
  27. Upgrade

    Upgrade redhat/xml-commons-resolver to a version that resolves this vulnerability.

    Fixed in 1.2-26.module+el8.1.0+3366+6dfb954c
  28. Upgrade

    Upgrade redhat/xmlstreambuffer to a version that resolves this vulnerability.

    Fixed in 1.5.4-8.module+el8.2.0+5723+4574fbff
  29. Upgrade

    Upgrade redhat/xsom to a version that resolves this vulnerability.

    Fixed in 0-19.20110809svn.module+el8.1.0+3366+6dfb954c
  30. Upgrade

    Upgrade redhat/bea-stax-api to a version that resolves this vulnerability.

    Fixed in 1.2.0-16.module+el8.1.0+3366+6dfb954c
  31. Upgrade

    Upgrade redhat/glassfish-jaxb-core to a version that resolves this vulnerability.

    Fixed in 2.2.11-11.module+el8.1.0+3366+6dfb954c
  32. Upgrade

    Upgrade redhat/glassfish-jaxb-runtime to a version that resolves this vulnerability.

    Fixed in 2.2.11-11.module+el8.1.0+3366+6dfb954c
  33. Upgrade

    Upgrade redhat/glassfish-jaxb-txw2 to a version that resolves this vulnerability.

    Fixed in 2.2.11-11.module+el8.1.0+3366+6dfb954c
  34. Upgrade

    Upgrade redhat/jackson-jaxrs-json-provider to a version that resolves this vulnerability.

    Fixed in 2.21.4-1.module+el8.4.0+24531+dcbbef34
  35. Upgrade

    Upgrade redhat/jackson-module-jaxb-annotations to a version that resolves this vulnerability.

    Fixed in 2.21.4-1.module+el8.4.0+25308+2720d8c5.1
  36. Upgrade

    Upgrade redhat/javassist-javadoc to a version that resolves this vulnerability.

    Fixed in 3.18.1-8.module+el8.1.0+3366+6dfb954c
  37. Upgrade

    Upgrade redhat/pki-servlet to a version that resolves this vulnerability.

    Fixed in 4.0-api-9.0.30-1.module+el8.4.0+23942+fa6501e9.3
  38. Upgrade

    Upgrade redhat/python-nss-debugsource to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.1.0+3366+6dfb954c
  39. Upgrade

    Upgrade redhat/python-nss-doc to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.1.0+3366+6dfb954c
  40. Upgrade

    Upgrade redhat/python3-nss to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.1.0+3366+6dfb954c
  41. Upgrade

    Upgrade redhat/python3-nss-debuginfo to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.1.0+3366+6dfb954c
  42. Upgrade

    Upgrade redhat/slf4j-jdk14 to a version that resolves this vulnerability.

    Fixed in 1.7.25-4.module+el8.1.0+3366+6dfb954c

Event History

Nov 12, 2026
Advisory Published
via Red Hat·12:00 AM
Data Sourced
via Red Hat·12:00 AM
RemedyDescriptionAffected Software

Frequently Asked Questions

1

What component is affected by the denial-of-service issues?

The issues affect the jackson-core component included in the pki-deps:10.6 update for the PKI Core package set.

2

What input conditions can trigger the reported denial-of-service vulnerabilities?

One issue involves malformed token processing that can cause unbounded StringBuilder growth. The other involves excessively long JSON property names.

3

Are fixes for both reported CVEs included in this update?

Yes. The update lists security fixes for CVE-2026-89425 and CVE-2026-68498.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203