RLSA-2026:90909: Important: pki-deps:10.6 security update

Published Oct 29, 2026
·
Updated

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.

Security Fix(es):

com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

60 affected componentsFixes available
rocky-linux/apache-commons-collections<0:3.2.2-10.module+el8.10.0+1763+c7c02164
0:3.2.2-10.module+el8.10.0+1763+c7c02164
rocky-linux/apache-commons-collections<0:3.2.2-10.module+el8.10.0+2052+1b0fb438
0:3.2.2-10.module+el8.10.0+2052+1b0fb438
rocky-linux/apache-commons-collections<0:3.2.2-10.module+el8.3.0+74+855e3f5d
0:3.2.2-10.module+el8.3.0+74+855e3f5d
rocky-linux/apache-commons-lang<0:2.6-21.module+el8.10.0+1763+c7c02164
0:2.6-21.module+el8.10.0+1763+c7c02164
rocky-linux/apache-commons-lang<0:2.6-21.module+el8.3.0+74+855e3f5d
0:2.6-21.module+el8.3.0+74+855e3f5d
rocky-linux/apache-commons-net<0:3.6-3.module+el8.10.0+1763+c7c02164
0:3.6-3.module+el8.10.0+1763+c7c02164
rocky-linux/apache-commons-net<0:3.6-3.module+el8.10.0+2052+1b0fb438
0:3.6-3.module+el8.10.0+2052+1b0fb438
rocky-linux/apache-commons-net<0:3.6-3.module+el8.3.0+74+855e3f5d
0:3.6-3.module+el8.3.0+74+855e3f5d
rocky-linux/bea-stax<0:1.2.0-16.module+el8.10.0+1763+c7c02164
0:1.2.0-16.module+el8.10.0+1763+c7c02164
rocky-linux/bea-stax<0:1.2.0-16.module+el8.10.0+2052+1b0fb438
0:1.2.0-16.module+el8.10.0+2052+1b0fb438
rocky-linux/glassfish-fastinfoset<0:1.2.13-9.module+el8.10.0+1763+c7c02164
0:1.2.13-9.module+el8.10.0+1763+c7c02164
rocky-linux/glassfish-fastinfoset<0:1.2.13-9.module+el8.10.0+2052+1b0fb438
0:1.2.13-9.module+el8.10.0+2052+1b0fb438
rocky-linux/glassfish-jaxb<0:2.2.11-12.module+el8.10.0+1763+c7c02164
0:2.2.11-12.module+el8.10.0+1763+c7c02164
rocky-linux/glassfish-jaxb<0:2.2.11-12.module+el8.10.0+2052+1b0fb438
0:2.2.11-12.module+el8.10.0+2052+1b0fb438
rocky-linux/glassfish-jaxb-api<0:2.2.12-8.module+el8.10.0+1763+c7c02164
0:2.2.12-8.module+el8.10.0+1763+c7c02164
rocky-linux/glassfish-jaxb-api<0:2.2.12-8.module+el8.10.0+2052+1b0fb438
0:2.2.12-8.module+el8.10.0+2052+1b0fb438
rocky-linux/jackson-annotations<0:2.21-1.module+el8.10.0+40260+021059e6
0:2.21-1.module+el8.10.0+40260+021059e6
rocky-linux/jackson-core<0:2.21.4-1.module+el8.10.0+40260+021059e6
0:2.21.4-1.module+el8.10.0+40260+021059e6
rocky-linux/jackson-core<0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3
0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3
rocky-linux/jackson-databind<0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1
0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1
rocky-linux/jackson-databind<0:2.21.4-1.module+el8.10.0+40260+021059e6
0:2.21.4-1.module+el8.10.0+40260+021059e6
rocky-linux/jackson-jaxrs-providers<0:2.21.4-1.module+el8.10.0+40260+021059e6
0:2.21.4-1.module+el8.10.0+40260+021059e6
rocky-linux/jackson-modules-base<0:2.21.4-2.module+el8.10.0+40260+021059e6
0:2.21.4-2.module+el8.10.0+40260+021059e6
rocky-linux/jakarta-commons-httpclient<1:3.1-28.module+el8.10.0+1763+c7c02164
1:3.1-28.module+el8.10.0+1763+c7c02164
rocky-linux/jakarta-commons-httpclient<1:3.1-28.module+el8.10.0+2052+1b0fb438
1:3.1-28.module+el8.10.0+2052+1b0fb438
rocky-linux/jakarta-commons-httpclient<1:3.1-28.module+el8.3.0+74+855e3f5d
1:3.1-28.module+el8.3.0+74+855e3f5d
rocky-linux/javassist<0:3.18.1-8.module+el8.10.0+1763+c7c02164
0:3.18.1-8.module+el8.10.0+1763+c7c02164
rocky-linux/javassist<0:3.18.1-8.module+el8.10.0+2052+1b0fb438
0:3.18.1-8.module+el8.10.0+2052+1b0fb438
rocky-linux/javassist<0:3.18.1-8.module+el8.3.0+74+855e3f5d
0:3.18.1-8.module+el8.3.0+74+855e3f5d
rocky-linux/pki-servlet-engine<1:9.0.62-1.module+el8.10.0+1767+f923f786
1:9.0.62-1.module+el8.10.0+1767+f923f786
rocky-linux/pki-servlet-engine<1:9.0.62-1.module+el8.10.0+2052+1b0fb438
1:9.0.62-1.module+el8.10.0+2052+1b0fb438
rocky-linux/relaxngdatatype<0:2011.1-7.module+el8.10.0+1763+c7c02164
0:2011.1-7.module+el8.10.0+1763+c7c02164
rocky-linux/relaxngdatatype<0:2011.1-7.module+el8.10.0+2052+1b0fb438
0:2011.1-7.module+el8.10.0+2052+1b0fb438
rocky-linux/slf4j<0:1.7.25-4.module+el8.10.0+1763+c7c02164
0:1.7.25-4.module+el8.10.0+1763+c7c02164
rocky-linux/slf4j<0:1.7.25-4.module+el8.10.0+2052+1b0fb438
0:1.7.25-4.module+el8.10.0+2052+1b0fb438
rocky-linux/slf4j<0:1.7.25-4.module+el8.6.0+843+5a13dac3
0:1.7.25-4.module+el8.6.0+843+5a13dac3
rocky-linux/slf4j<0:1.7.25-4.module+el8.3.0+74+855e3f5d
0:1.7.25-4.module+el8.3.0+74+855e3f5d
rocky-linux/slf4j<0:1.7.25-4.module+el8.10.0+2003+8aeac9cb
0:1.7.25-4.module+el8.10.0+2003+8aeac9cb
rocky-linux/stax-ex<0:1.7.7-8.module+el8.10.0+1763+c7c02164
0:1.7.7-8.module+el8.10.0+1763+c7c02164
rocky-linux/stax-ex<0:1.7.7-8.module+el8.10.0+2052+1b0fb438
0:1.7.7-8.module+el8.10.0+2052+1b0fb438
rocky-linux/velocity<0:1.7-24.module+el8.10.0+1763+c7c02164
0:1.7-24.module+el8.10.0+1763+c7c02164
rocky-linux/velocity<0:1.7-24.module+el8.10.0+2052+1b0fb438
0:1.7-24.module+el8.10.0+2052+1b0fb438
rocky-linux/velocity<0:1.7-24.module+el8.3.0+74+855e3f5d
0:1.7-24.module+el8.3.0+74+855e3f5d
rocky-linux/xalan-j2<0:2.7.1-38.module+el8.10.0+1763+c7c02164
0:2.7.1-38.module+el8.10.0+1763+c7c02164
rocky-linux/xalan-j2<0:2.7.1-38.module+el8.10.0+2052+1b0fb438
0:2.7.1-38.module+el8.10.0+2052+1b0fb438
rocky-linux/xalan-j2<0:2.7.1-38.module+el8.3.0+74+855e3f5d
0:2.7.1-38.module+el8.3.0+74+855e3f5d
rocky-linux/xerces-j2<0:2.11.0-34.module+el8.10.0+1763+c7c02164
0:2.11.0-34.module+el8.10.0+1763+c7c02164
rocky-linux/xerces-j2<0:2.11.0-34.module+el8.10.0+2052+1b0fb438
0:2.11.0-34.module+el8.10.0+2052+1b0fb438
rocky-linux/xerces-j2<0:2.11.0-34.module+el8.3.0+74+855e3f5d
0:2.11.0-34.module+el8.3.0+74+855e3f5d
rocky-linux/xml-commons-apis<0:1.4.01-25.module+el8.10.0+1763+c7c02164
0:1.4.01-25.module+el8.10.0+1763+c7c02164
rocky-linux/xml-commons-apis<0:1.4.01-25.module+el8.10.0+2052+1b0fb438
0:1.4.01-25.module+el8.10.0+2052+1b0fb438
rocky-linux/xml-commons-apis<0:1.4.01-25.module+el8.10.0+2003+8aeac9cb
0:1.4.01-25.module+el8.10.0+2003+8aeac9cb
rocky-linux/xml-commons-apis<0:1.4.01-25.module+el8.3.0+74+855e3f5d
0:1.4.01-25.module+el8.3.0+74+855e3f5d
rocky-linux/xml-commons-resolver<0:1.2-26.module+el8.10.0+2052+1b0fb438
0:1.2-26.module+el8.10.0+2052+1b0fb438
rocky-linux/xml-commons-resolver<0:1.2-26.module+el8.10.0+1763+c7c02164
0:1.2-26.module+el8.10.0+1763+c7c02164
rocky-linux/xml-commons-resolver<0:1.2-26.module+el8.3.0+74+855e3f5d
0:1.2-26.module+el8.3.0+74+855e3f5d
rocky-linux/xmlstreambuffer<0:1.5.4-8.module+el8.10.0+1763+c7c02164
0:1.5.4-8.module+el8.10.0+1763+c7c02164
rocky-linux/xmlstreambuffer<0:1.5.4-8.module+el8.10.0+2052+1b0fb438
0:1.5.4-8.module+el8.10.0+2052+1b0fb438
rocky-linux/xsom<0:0-19.20110809svn.module+el8.10.0+1763+c7c02164
0:0-19.20110809svn.module+el8.10.0+1763+c7c02164
rocky-linux/xsom<0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438
0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade rocky-linux/apache-commons-collections to a version that resolves this vulnerability.

    Fixed in 0:3.2.2-10.module+el8.10.0+1763+c7c02164
  2. Upgrade

    Upgrade rocky-linux/apache-commons-collections to a version that resolves this vulnerability.

    Fixed in 0:3.2.2-10.module+el8.10.0+2052+1b0fb438
  3. Upgrade

    Upgrade rocky-linux/apache-commons-collections to a version that resolves this vulnerability.

    Fixed in 0:3.2.2-10.module+el8.3.0+74+855e3f5d
  4. Upgrade

    Upgrade rocky-linux/apache-commons-lang to a version that resolves this vulnerability.

    Fixed in 0:2.6-21.module+el8.10.0+1763+c7c02164
  5. Upgrade

    Upgrade rocky-linux/apache-commons-lang to a version that resolves this vulnerability.

    Fixed in 0:2.6-21.module+el8.3.0+74+855e3f5d
  6. Upgrade

    Upgrade rocky-linux/apache-commons-net to a version that resolves this vulnerability.

    Fixed in 0:3.6-3.module+el8.10.0+1763+c7c02164
  7. Upgrade

    Upgrade rocky-linux/apache-commons-net to a version that resolves this vulnerability.

    Fixed in 0:3.6-3.module+el8.10.0+2052+1b0fb438
  8. Upgrade

    Upgrade rocky-linux/apache-commons-net to a version that resolves this vulnerability.

    Fixed in 0:3.6-3.module+el8.3.0+74+855e3f5d
  9. Upgrade

    Upgrade rocky-linux/bea-stax to a version that resolves this vulnerability.

    Fixed in 0:1.2.0-16.module+el8.10.0+1763+c7c02164
  10. Upgrade

    Upgrade rocky-linux/bea-stax to a version that resolves this vulnerability.

    Fixed in 0:1.2.0-16.module+el8.10.0+2052+1b0fb438
  11. Upgrade

    Upgrade rocky-linux/glassfish-fastinfoset to a version that resolves this vulnerability.

    Fixed in 0:1.2.13-9.module+el8.10.0+1763+c7c02164
  12. Upgrade

    Upgrade rocky-linux/glassfish-fastinfoset to a version that resolves this vulnerability.

    Fixed in 0:1.2.13-9.module+el8.10.0+2052+1b0fb438
  13. Upgrade

    Upgrade rocky-linux/glassfish-jaxb to a version that resolves this vulnerability.

    Fixed in 0:2.2.11-12.module+el8.10.0+1763+c7c02164
  14. Upgrade

    Upgrade rocky-linux/glassfish-jaxb to a version that resolves this vulnerability.

    Fixed in 0:2.2.11-12.module+el8.10.0+2052+1b0fb438
  15. Upgrade

    Upgrade rocky-linux/glassfish-jaxb-api to a version that resolves this vulnerability.

    Fixed in 0:2.2.12-8.module+el8.10.0+1763+c7c02164
  16. Upgrade

    Upgrade rocky-linux/glassfish-jaxb-api to a version that resolves this vulnerability.

    Fixed in 0:2.2.12-8.module+el8.10.0+2052+1b0fb438
  17. Upgrade

    Upgrade rocky-linux/jackson-annotations to a version that resolves this vulnerability.

    Fixed in 0:2.21-1.module+el8.10.0+40260+021059e6
  18. Upgrade

    Upgrade rocky-linux/jackson-core to a version that resolves this vulnerability.

    Fixed in 0:2.21.4-1.module+el8.10.0+40260+021059e6
  19. Upgrade

    Upgrade rocky-linux/jackson-core to a version that resolves this vulnerability.

    Fixed in 0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3
  20. Upgrade

    Upgrade rocky-linux/jackson-databind to a version that resolves this vulnerability.

    Fixed in 0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1
  21. Upgrade

    Upgrade rocky-linux/jackson-databind to a version that resolves this vulnerability.

    Fixed in 0:2.21.4-1.module+el8.10.0+40260+021059e6
  22. Upgrade

    Upgrade rocky-linux/jackson-jaxrs-providers to a version that resolves this vulnerability.

    Fixed in 0:2.21.4-1.module+el8.10.0+40260+021059e6
  23. Upgrade

    Upgrade rocky-linux/jackson-modules-base to a version that resolves this vulnerability.

    Fixed in 0:2.21.4-2.module+el8.10.0+40260+021059e6
  24. Upgrade

    Upgrade rocky-linux/jakarta-commons-httpclient to a version that resolves this vulnerability.

    Fixed in 1:3.1-28.module+el8.10.0+1763+c7c02164
  25. Upgrade

    Upgrade rocky-linux/jakarta-commons-httpclient to a version that resolves this vulnerability.

    Fixed in 1:3.1-28.module+el8.10.0+2052+1b0fb438
  26. Upgrade

    Upgrade rocky-linux/jakarta-commons-httpclient to a version that resolves this vulnerability.

    Fixed in 1:3.1-28.module+el8.3.0+74+855e3f5d
  27. Upgrade

    Upgrade rocky-linux/javassist to a version that resolves this vulnerability.

    Fixed in 0:3.18.1-8.module+el8.10.0+1763+c7c02164
  28. Upgrade

    Upgrade rocky-linux/javassist to a version that resolves this vulnerability.

    Fixed in 0:3.18.1-8.module+el8.10.0+2052+1b0fb438
  29. Upgrade

    Upgrade rocky-linux/javassist to a version that resolves this vulnerability.

    Fixed in 0:3.18.1-8.module+el8.3.0+74+855e3f5d
  30. Upgrade

    Upgrade rocky-linux/pki-servlet-engine to a version that resolves this vulnerability.

    Fixed in 1:9.0.62-1.module+el8.10.0+1767+f923f786
  31. Upgrade

    Upgrade rocky-linux/pki-servlet-engine to a version that resolves this vulnerability.

    Fixed in 1:9.0.62-1.module+el8.10.0+2052+1b0fb438
  32. Upgrade

    Upgrade rocky-linux/relaxngDatatype to a version that resolves this vulnerability.

    Fixed in 0:2011.1-7.module+el8.10.0+1763+c7c02164
  33. Upgrade

    Upgrade rocky-linux/relaxngDatatype to a version that resolves this vulnerability.

    Fixed in 0:2011.1-7.module+el8.10.0+2052+1b0fb438
  34. Upgrade

    Upgrade rocky-linux/slf4j to a version that resolves this vulnerability.

    Fixed in 0:1.7.25-4.module+el8.10.0+1763+c7c02164
  35. Upgrade

    Upgrade rocky-linux/slf4j to a version that resolves this vulnerability.

    Fixed in 0:1.7.25-4.module+el8.10.0+2052+1b0fb438
  36. Upgrade

    Upgrade rocky-linux/slf4j to a version that resolves this vulnerability.

    Fixed in 0:1.7.25-4.module+el8.6.0+843+5a13dac3
  37. Upgrade

    Upgrade rocky-linux/slf4j to a version that resolves this vulnerability.

    Fixed in 0:1.7.25-4.module+el8.3.0+74+855e3f5d
  38. Upgrade

    Upgrade rocky-linux/slf4j to a version that resolves this vulnerability.

    Fixed in 0:1.7.25-4.module+el8.10.0+2003+8aeac9cb
  39. Upgrade

    Upgrade rocky-linux/stax-ex to a version that resolves this vulnerability.

    Fixed in 0:1.7.7-8.module+el8.10.0+1763+c7c02164
  40. Upgrade

    Upgrade rocky-linux/stax-ex to a version that resolves this vulnerability.

    Fixed in 0:1.7.7-8.module+el8.10.0+2052+1b0fb438
  41. Upgrade

    Upgrade rocky-linux/velocity to a version that resolves this vulnerability.

    Fixed in 0:1.7-24.module+el8.10.0+1763+c7c02164
  42. Upgrade

    Upgrade rocky-linux/velocity to a version that resolves this vulnerability.

    Fixed in 0:1.7-24.module+el8.10.0+2052+1b0fb438
  43. Upgrade

    Upgrade rocky-linux/velocity to a version that resolves this vulnerability.

    Fixed in 0:1.7-24.module+el8.3.0+74+855e3f5d
  44. Upgrade

    Upgrade rocky-linux/xalan-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-38.module+el8.10.0+1763+c7c02164
  45. Upgrade

    Upgrade rocky-linux/xalan-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-38.module+el8.10.0+2052+1b0fb438
  46. Upgrade

    Upgrade rocky-linux/xalan-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-38.module+el8.3.0+74+855e3f5d
  47. Upgrade

    Upgrade rocky-linux/xerces-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.11.0-34.module+el8.10.0+1763+c7c02164
  48. Upgrade

    Upgrade rocky-linux/xerces-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.11.0-34.module+el8.10.0+2052+1b0fb438
  49. Upgrade

    Upgrade rocky-linux/xerces-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.11.0-34.module+el8.3.0+74+855e3f5d
  50. Upgrade

    Upgrade rocky-linux/xml-commons-apis to a version that resolves this vulnerability.

    Fixed in 0:1.4.01-25.module+el8.10.0+1763+c7c02164
  51. Upgrade

    Upgrade rocky-linux/xml-commons-apis to a version that resolves this vulnerability.

    Fixed in 0:1.4.01-25.module+el8.10.0+2052+1b0fb438
  52. Upgrade

    Upgrade rocky-linux/xml-commons-apis to a version that resolves this vulnerability.

    Fixed in 0:1.4.01-25.module+el8.10.0+2003+8aeac9cb
  53. Upgrade

    Upgrade rocky-linux/xml-commons-apis to a version that resolves this vulnerability.

    Fixed in 0:1.4.01-25.module+el8.3.0+74+855e3f5d
  54. Upgrade

    Upgrade rocky-linux/xml-commons-resolver to a version that resolves this vulnerability.

    Fixed in 0:1.2-26.module+el8.10.0+2052+1b0fb438
  55. Upgrade

    Upgrade rocky-linux/xml-commons-resolver to a version that resolves this vulnerability.

    Fixed in 0:1.2-26.module+el8.10.0+1763+c7c02164
  56. Upgrade

    Upgrade rocky-linux/xml-commons-resolver to a version that resolves this vulnerability.

    Fixed in 0:1.2-26.module+el8.3.0+74+855e3f5d
  57. Upgrade

    Upgrade rocky-linux/xmlstreambuffer to a version that resolves this vulnerability.

    Fixed in 0:1.5.4-8.module+el8.10.0+1763+c7c02164
  58. Upgrade

    Upgrade rocky-linux/xmlstreambuffer to a version that resolves this vulnerability.

    Fixed in 0:1.5.4-8.module+el8.10.0+2052+1b0fb438
  59. Upgrade

    Upgrade rocky-linux/xsom to a version that resolves this vulnerability.

    Fixed in 0:0-19.20110809svn.module+el8.10.0+1763+c7c02164
  60. Upgrade

    Upgrade rocky-linux/xsom to a version that resolves this vulnerability.

    Fixed in 0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438
  61. Upgrade

    Upgrade pki-deps to a version that resolves this vulnerability.

    Fixed in 10.6

Event History

Oct 29, 2026
Advisory Published
via OSV·12:01 PM
Data Sourced
via OSV·12:01 PM
DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203