{"id":"ALSA-2026:90909","summary":"Important: pki-deps:10.6 security update","details":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.  \n\nSecurity Fix(es):  \n\n  * com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n  * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n  * com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","modified":"2026-10-29T11:02:25.387689752Z","published":"2026-10-27T00:00:00Z","related":["CVE-2026-68498","CVE-2026-89425","CVE-2026-91777"],"upstream":["CVE-2026-68498","CVE-2026-89425","CVE-2026-91777"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:90909"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-68498"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-89425"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-91777"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2539084"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2539085"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2554486"},{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2026-90909.html"}],"affected":[{"package":{"name":"apache-commons-collections","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/apache-commons-collections"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-10.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"apache-commons-lang","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/apache-commons-lang"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-21.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"apache-commons-net","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/apache-commons-net"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-3.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"bea-stax-api","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/bea-stax-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-16.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"glassfish-fastinfoset","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/glassfish-fastinfoset"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-9.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"glassfish-jaxb-api","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/glassfish-jaxb-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-8.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"glassfish-jaxb-core","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/glassfish-jaxb-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"glassfish-jaxb-runtime","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/glassfish-jaxb-runtime"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"glassfish-jaxb-txw2","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/glassfish-jaxb-txw2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"jackson-annotations","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/jackson-annotations"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1.module_el8.10.0+4235+0924958e"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"jackson-core","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/jackson-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4329+908ad137.3"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"jackson-databind","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4329+908ad137.1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"jackson-jaxrs-json-provider","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/jackson-jaxrs-json-provider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4235+0924958e"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"jackson-jaxrs-providers","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/jackson-jaxrs-providers"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4235+0924958e"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"jackson-module-jaxb-annotations","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/jackson-module-jaxb-annotations"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-2.module_el8.10.0+4235+0924958e"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"jakarta-commons-httpclient","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/jakarta-commons-httpclient"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"javassist","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/javassist"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-8.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"javassist-javadoc","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/javassist-javadoc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-8.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"pki-servlet-engine","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/pki-servlet-engine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module_el8.10.0+3791+e0637953"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"relaxngDatatype","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/relaxngDatatype"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2011.1-7.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"slf4j","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/slf4j"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.25-4.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"slf4j-jdk14","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/slf4j-jdk14"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.25-4.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"stax-ex","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/stax-ex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-8.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"velocity","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/velocity"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7-24.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"xalan-j2","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/xalan-j2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-38.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"xerces-j2","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/xerces-j2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-34.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"xml-commons-apis","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/xml-commons-apis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.01-25.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"xml-commons-resolver","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/xml-commons-resolver"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-26.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"xmlstreambuffer","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/xmlstreambuffer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-8.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}},{"package":{"name":"xsom","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/xsom"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-19.20110809svn.module_el8.5.0+2577+9e95fe00"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:90909.json"}}],"schema_version":"1.9.2"}