Withdrawn: CLEANSTART-2026-FV79231 — Netty is a network application framework for development of protocol servers and clients

Withdrawn by the publisher.

Affected: CleanStart: s3proxy

Multiple security vulnerabilities affect the s3proxy package. Netty is a network application framework for development of protocol servers and clients. See references for individual vulnerability details.

CVE-2026-54513 — jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Affected: FasterXML jackson-databind, Red Hat Cryostat 4 on RHEL 9, Red Hat AMQ Broker 7.13.6, Red Hat AMQ Broker 7.14.1, Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.14, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.5 and 37 more

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Most recent entries from all

Withdrawn: CLEANSTART-2026-FV79231 — Netty is a network application framework for development of protocol servers and clients

CVE-2026-54513 — jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)