https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:22:54 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0914 certfr-2026-avi-0914 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0914 https://cve.radiocsirt.org/vuln/cleanstart-2026-aa21675 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: activemq, CleanStart: apache-nifi, CleanStart: apache-nifi-registry, CleanStart: confluent-kafka, CleanStart: elasticsearch, CleanStart: hazelcast, CleanStart: kafka, CleanStart: logstash-fips, CleanStart: rundeck, CleanStart: sonarqube and 2 more</p> <p>CVE-2026-54516 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: activemq, CleanStart: apache-nifi, CleanStart: apache-nifi-registry, CleanStart: confluent-kafka, CleanStart: elasticsearch, CleanStart: hazelcast, CleanStart: kafka, CleanStart: logstash-fips, CleanStart: rundeck, CleanStart: sonarqube and 2 more</p> <p>CVE-2026-54516 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-aa21675 https://cve.radiocsirt.org/vuln/euvd-2026-329792 EUVD-2026-329792 https://cve.radiocsirt.org/vuln/euvd-2026-329792 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54516 <p>jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(&#34;renamed&#34;) on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.</p> <p>jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(&#34;renamed&#34;) on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54516 https://cve.radiocsirt.org/vuln/ghsa-9fxm-vc8v-hj55 <p><strong>Affected:</strong> Maven: com.fasterxml.jackson.core:jackson-databind, Maven: tools.jackson.core:jackson-databind</p> <p>## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty(&#34;renamed&#34;)` on the getter and `@JsonIgnore` on the setter to be renamed rather than dropped. With `MapperFeature.INFER_PROPERTY_MUTATORS` enabled (default), the private backing field is retained; during deserialization `BeanDeserializerFactory.addBeanProps()` sees `hasField()==true`, builds a `FieldProperty`, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the `@JsonIgnore` on the setter.</p> <p>## Impact POJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.</p> <p>## Affected / Patched (verified via `git tag --contains`) - 2.21 line: `&gt;= 2.21.0, &lt; 2.21.4` -&gt; fixed in **2.21.4** (backport `c3d56dd`, #5968) - 3.x line: `&gt;= 3.0.0, &lt; 3.1.4` -&gt; fixed in **3.1.4** (#5967, `e88cb17`)</p> <p>## Severity / CWE Maintainer: minor. Reporter: HIGH. CWE-915.</p> <p>## Credits Omkhar Arasaratnam (@omkhar) - finder.</p> <p><strong>Affected:</strong> Maven: com.fasterxml.jackson.core:jackson-databind, Maven: tools.jackson.core:jackson-databind</p> <p>## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty(&#34;renamed&#34;)` on the getter and `@JsonIgnore` on the setter to be renamed rather than dropped. With `MapperFeature.INFER_PROPERTY_MUTATORS` enabled (default), the private backing field is retained; during deserialization `BeanDeserializerFactory.addBeanProps()` sees `hasField()==true`, builds a `FieldProperty`, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the `@JsonIgnore` on the setter.</p> <p>## Impact POJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.</p> <p>## Affected / Patched (verified via `git tag --contains`) - 2.21 line: `&gt;= 2.21.0, &lt; 2.21.4` -&gt; fixed in **2.21.4** (backport `c3d56dd`, #5968) - 3.x line: `&gt;= 3.0.0, &lt; 3.1.4` -&gt; fixed in **3.1.4** (#5967, `e88cb17`)</p> <p>## Severity / CWE Maintainer: minor. Reporter: HIGH. CWE-915.</p> <p>## Credits Omkhar Arasaratnam (@omkhar) - finder.</p> https://cve.radiocsirt.org/vuln/ghsa-9fxm-vc8v-hj55 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54516 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jackson-databind, Ubuntu:Pro:16.04:LTS: jackson-databind, Ubuntu:18.04:LTS: jackson-databind, Ubuntu:20.04:LTS: jackson-databind, Ubuntu:22.04:LTS: jackson-databind, Ubuntu:24.04:LTS: jackson-databind, Ubuntu:25.10: jackson-databind, Ubuntu:26.04:LTS: jackson-databind</p> <p>jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(&#34;renamed&#34;) on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jackson-databind, Ubuntu:Pro:16.04:LTS: jackson-databind, Ubuntu:18.04:LTS: jackson-databind, Ubuntu:20.04:LTS: jackson-databind, Ubuntu:22.04:LTS: jackson-databind, Ubuntu:24.04:LTS: jackson-databind, Ubuntu:25.10: jackson-databind, Ubuntu:26.04:LTS: jackson-databind</p> <p>jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(&#34;renamed&#34;) on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54516 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2058 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FasterXML Jackson ausnutzen, um Schutzmechanismen und Autorisierungsregeln zu umgehen, Daten zu manipulieren, Informationen offenzulegen oder einen Denial-of-Service zu verursachen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FasterXML Jackson ausnutzen, um Schutzmechanismen und Autorisierungsregeln zu umgehen, Daten zu manipulieren, Informationen offenzulegen oder einen Denial-of-Service zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2058