|
|
Log in / Subscribe / Register

SUSE alert SUSE-SU-2026:2801-1 (jackson-annotations, jackson-bom, jackson-core, jackson- databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent)



From:
              SLE-SECURITY-UPDATES <null@suse.de>


To:
              sle-security-updates@lists.suse.com


Subject:
              SUSE-SU-2026:2801-1: important: Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent


Date:
              Thu, 09 Jul 2026 08:31:12 -0000


Message-ID:
              <178358587250.683.7515958594086102546@aaee731399ed>


# Security update for jackson-annotations, jackson-bom, jackson-core, jackson-
databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent

Announcement ID: SUSE-SU-2026:2801-1  
Release Date: 2026-07-08T19:05:27Z  
Rating: important  
References:

  * bsc#1268603
  * bsc#1268897
  * bsc#1268898
  * bsc#1268899
  * bsc#1268902

  
Cross-References:

  * CVE-2026-54512
  * CVE-2026-54513
  * CVE-2026-54514
  * CVE-2026-54515

  
CVSS scores:

  * CVE-2026-54512 ( SUSE ):  8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-54512 ( NVD ):  8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-54513 ( SUSE ):  8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-54513 ( NVD ):  8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-54513 ( NVD ):  8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-54514 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  * CVE-2026-54514 ( NVD ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  * CVE-2026-54515 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  * CVE-2026-54515 ( NVD ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

  
Affected Products:

  * Basesystem Module 15-SP7
  * Development Tools Module 15-SP7
  * SUSE Linux Enterprise Desktop 15 SP7
  * SUSE Linux Enterprise High Performance Computing 15 SP4
  * SUSE Linux Enterprise High Performance Computing 15 SP5
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
  * SUSE Linux Enterprise Real Time 15 SP7
  * SUSE Linux Enterprise Server 15 SP4
  * SUSE Linux Enterprise Server 15 SP4 LTSS
  * SUSE Linux Enterprise Server 15 SP5
  * SUSE Linux Enterprise Server 15 SP5 LTSS
  * SUSE Linux Enterprise Server 15 SP6
  * SUSE Linux Enterprise Server 15 SP6 LTSS
  * SUSE Linux Enterprise Server 15 SP7
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4
  * SUSE Linux Enterprise Server for SAP Applications 15 SP5
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6
  * SUSE Linux Enterprise Server for SAP Applications 15 SP7

  
  
An update that solves four vulnerabilities and has one security fix can now be
installed.

## Description:

This update for jackson-annotations, jackson-bom, jackson-core, jackson-
databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes
the following issues

  * CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via
    generic type parameters that allows arbitrary class instantiation
    (bsc#1268897).
  * CVE-2026-54513: jackson-databind: array subtype allowlist bypass in
    BasicPolymorphicTypeValidator (bsc#1268898).
  * CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers
    eager DNS resolution (bsc#1268899).
  * CVE-2026-54515: jackson-databindi: case-insensitive deserialization bypasses
    per-property @JsonIgnoreProperties (bsc#1268902).
  * jackson-core: document length constraint bypass in blocking, async, and
    DataInput parsers (bsc#1268603).

Changes for jackson-annotations:

  * Update to 2.18.8
  * No changes since 2.17.3

Changes for jackson-bom:

  * Update to 2.18.8
  * Changes
  * # 68: Remove 'junit' 4.x dependency from 'jackson-base' 2.18.x

to help junit5 migration

  * 'base/pom.xml' now creates '${project.version.underscore}' for "cleansed"
    version of '${project.version}'

Changes for jackson-core:

  * Update to 2.18.8
  * Changes of 2.18.8
  * # 1611: Apply number-length validator on streaming integer path

of async parser

  * Changes of 2.18.7
  * # 1570: Fail parsing from 'DataInput' if 'StreamReadConstraints

.getMaxDocumentLength()' set (bsc#1268603, GHSA-2m67-wjpj-xhg9)

  * # 1600: Rework 3rd party licenses in jar

  * # 1602: 'UTF8DataInputJsonParser' needs to enforce

'StreamReadConstraints.maxNameLength' limit

  * Changes of 2.18.6
  * # 1512: Number-parsing fix for 'UTF8DataInputJsonParser'

  * # 1548: 'StreamReadConstraints.maxDocumentLength' not checked

when creating parser with fixed buffer

  * # 1555: Enforce 'StreamReadConstraints.maxNumberLength' for

non-blocking (async) parser

  * Changes of 2.18.5
  * # 1433: 'JsonParser#getNumberType()' throws

'JsonParseException' when the current token is non-numeric instead of returning
null

  * # 1446: Invalid package reference to "java.lang.foreign" from

'com.fasterxml.jackson.core:jackson-core' (from 'FastDoubleParser')

  * Changes of 2.18.3
  * # 1391: Fix issue where the parser can read back old number

state when parsing later numbers

  * # 1397: Jackson changes additional values to infinite in case

of special JSON structures and existing infinite values

  * # 1398: Fix issue that feature

COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom characterEscape is
used

  * Changes of 2.18.2
  * # 1359: Non-surrogate characters being incorrectly combined

when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is enabled

  * Changes of 2.18.1
  * # 1353: Use fastdoubleparser 1.0.90

  * Changes of 2.18.
  * # 223: 'UTF8JsonGenerator' writes supplementary characters as a

surrogate pair: should use 4-byte encoding

  * # 1230: Improve performance of 'float' and 'double' parsing

from 'TextBuffer'

  * # 1251: 'InternCache' replace synchronized with 'ReentrantLock'

  * the cache size limit is no longer strictly enforced for performance reasons
    but we should never go far about the limit
  * # 1252: 'ThreadLocalBufferManager' replace synchronized with

'ReentrantLock'

  * # 1257: Increase InternCache default max size from 100 to 200

  * # 1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'

  * # 1264: Rename shaded 'ch.randelshofer:fastdoubleparser'

classes to prevent use by downstream consumers

  * # 1271: Deprecate 'LockFreePool' implementation in 2.18 (remove

from 3.0)

  * # 1274: 'NUL'-corrupted keys, values on JSON serialization

  * # 1277: Add back Java 22 optimisation in FastDoubleParser

  * # 1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()

/getDecimalValue()' to avoid String allocation

  * # 1305: Make helper methods of 'WriterBasedJsonGenerator'

non-final to allow overriding

  * # 1310: Add new 'StreamReadConstraints' ('maxTokenCount') to

limit maximum number of Tokens allowed per document#

  * # 1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'

decoding proble

Changes for jackson-databind:

  * Update to 2.18.8
  * Changes of 2.18.8
  * # 5950: Improve 'UUIDeserializer' error handling

  * # 5951: Improve 'InetSocketAddress' deserialization

(bsc#1268899, CVE-2026-54514)

  * # 5969: '@JsonView' by-passed for some "setterless" creator

properties

  * # 5971: '@JsonView' by-passed for unwrapped creator parameters

  * # 5974: '@JsonIgnore' on Record property ignored with

'PropertyNamingStrategy'

  * # 5981: 'BasicPolymorphicTypeValidator' setting

'allowIfSubTypeIsArray()' should validate element type (bsc#1268898,
CVE-2026-54513)

  * # 5988: 'PolymorphicTypeValidator' needs to validate generic

type parameters too (bsc#1268897, CVE-2026-54512)

  * # 5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'

fold case using JVM default locale (Turkish-I bug)

  * Changes of 2.18.4
  * # 4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on

Record property ignored for deserialization

  * # 5049: Duplicate creator property "b" (index 0 vs 1) on simple

java record

  * Changes of 2.18.3
  * # 4444: The 'KeyDeserializer' specified in the class with

'@JsonDeserialize(keyUsing = ...)' is overwritten by the 'KeyDeserializer'
specified in the 'ObjectMapper'.

  * # 4827: Subclassed Throwable deserialization fails since

v2.18.0 - no creator index for property 'cause'

  * # 4844: Fix wrapped array handling wrt 'null' by

'StdDeserializer'

  * # 4848: Avoid type pollution in 'StringCollectionDeserializer'

  * # 4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not

work with multiple constructors since 2.18

  * # 4878: When serializing a Map via

Converter(StdDelegatingSerializer), a NullPointerException is thrown due to
missing key serializer

  * # 4908: Deserialization behavior change with @JsonCreator and

@ConstructorProperties between 2.17 and 2.18

  * # 4917: 'BigDecimal' deserialization issue when using

'@JsonCreator'

  * # 4920: Creator properties are ignored on abstract types when

collecting bean properties, breaking AsExternalTypeDeserializer

  * # 4922: Failing '@JsonMerge' with a custom Map

  * # 4932: Conversion of 'MissingNode' throws

'JsonProcessingException'

  * Changes of 2.18.2
  * # 4733: Wrong serialization of Type Ids for certain types of

Enum values

  * # 4742: Deserialization with Builder, External type id,

'@JsonCreator' failing

  * # 4777: 'StdValueInstantiator.withArgsCreator' is now set for

creators with no arguments

  * # 4783 Possibly wrong behavior of @JsonMerge

  * # 4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'

hides actual error

  * # 4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides

'@JsonProperty' values

  * # 4790: Fix '@JsonAnySetter' issue with "setter" method

(related to #4639)

  * # 4807: Improve 'FactoryBasedEnumDeserializer' to work better

with XML module

  * # 4810: Deserialization using '@JsonCreator' with renamed

property failing (since 2.18)

  * Changes of 2.18.1
  * # 4508: Deserialized JsonAnySetter field in Kotlin data class

is null

  * # 4639: @JsonAnySetter on field ignoring unrecognized

properties if they are declared before the last recognized properties in JSON

  * # 4718: Should not fail on trying to serialize

'java.time.DateTimeException'

  * # 4724: Deserialization behavior change with Records,

'@JsonCreator' and '@JsonValue' between 2.17 and 2.18

  * # 4727: Eclipse having issues due'module-info' class "lost" on

2.18.0 jars

  * # 4741: When 'Include.NON_DEFAULT' setting is used on POJO,

empty values are not included in json if default is 'null'

  * # 4749: Fixed a problem with

'StdDelegatingSerializer#serializeWithType' looking up the serializer with the
wrong argument

  * Changes of 2.18.0
  * # 562: Allow '@JsonAnySetter' to flow through Creators

  * # 806: Problem with 'NamingStrategy', creator methods with

implicit names

  * # 2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and

field level '@JsonProperty'

  * # 3120: Return 'ListIterator' from 'ArrayNode.elements()'

  * # 3241: 'constructorDetector' seems to invalidate

'defaultSetterInfo' for nullability

  * # 3439: Java Record '@JsonAnySetter' value is null after

deserialization

  * # 4085: '@JsonView' does not work on class-level for records

  * # 4119: Exception when deserialization uses a record with a

constructor property with 'access=READ_ONLY'

  * # 4356: 'BeanDeserializerModifier::updateBuilder()' doesn't

work for beans with Creator methods

  * # 4407: 'null' type id handling does not work with

'writeTypePrefix()'

  * # 4452: '@JsonProperty' not serializing field names properly on

'@JsonCreator' in Record

  * # 4453: Allow JSON Integer to deserialize into a single-arg

constructor of parameter type 'double'

  * # 4456: Rework locking in 'DeserializerCache'

  * # 4458: Rework synchronized block from 'BeanDeserializerBase'

  * # 4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'

method is not called on the serializer

  * # 4472: Rework synchronized block in 'TypeDeserializerBase'

  * # 4483: Remove 'final' on method BeanSerializer.serialize()

  * # 4515: Rewrite Bean Property Introspection logic in Jackson

2.x

  * # 4545: Unexpected deserialization behavior with

'@JsonCreator', '@JsonProperty' and javac '-parameters'

  * # 4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper

.canSerialize()'

  * # 4580: Add 'MapperFeature

.SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator properties'
declaration order for sorting

  * # 4584: Provide extension point for detecting "primary"

Constructor for Kotlin (and similar) data classes

  * # 4602: Possible wrong use of _arrayDelegateDeserializer in

BeanDeserializerBase::deserializeFromObjectUsingNonDefault()

  * # 4617: Record property serialization order not preserved

  * # 4626: '@JsonIgnore' on Record property ignored for

deserialization, if there is getter override

  * # 4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'

ignored when serializing Records, if there is getter override

  * # 4634: '@JsonAnySetter' not working when annotated on both

constructor parameter & field

  * # 4678: Java records don't serialize with 'MapperFeature

.REQUIRE_SETTERS_FOR_GETTERS'

  * # 4688: Should allow deserializing with no-arg

'@JsonCreator(mode = DELEGATING)'

  * # 4694: Deserializing 'BigDecimal' with large number of

decimals result in incorrect value

  * # 4699: Add extra 'writeNumber()' method in 'TokenBuffer'

  * # 4709: Add 'JacksonCollectors' with 'toArrayNode()'

implementation

  * Fix #5962: Case-insensitive deserialization may use wrong
    @JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)
  * Fix "Not fully interpolated version" error with Maven 4

Changes for jackson-dataformats-binary:

  * Update to 2.18.8
  * Changes of 2.18.8
  * # 696: (ion) Incomplete number length validation in Ion decoder

(for 'BigDecimal' and/or 'BigInteger')

  * Changes of 2.18.6
  * # 645: (avro) Remove use of Avro 'Schema.Parser()

.setValidate()' to allow use of Avro core 1.12.1 (2.x)

  * # 649: (cbor, smile) 'StreamReadConstraints.maxDocumentLength'

not checked when creating parser with fixed buffer

  * # 651: (smile) Ensure Smile backend supports

'StreamReadConstraints.maxTokenCount'

  * # 652: (cbor) Ensure CBOR backend supports

  * Minor fix to 'ProtobufGenerator._reportEnumError()' helper method
  * Changes of 2.18.5
  * # 599: (cbor) Unable to deserialize stringref-enabled CBOR with

ignored properties

  * # 623: (ion) Upgrade 'ion-java' dep to 1.11.11 (from 1.11.10)

  * Changes of 2.18.4
  * # 569: (ion) 'IonParser' fails to parse some 'long' values

saying they are out of range when they are not

  * # 584: (protobuf) Missing 'JsonToken.END_OBJECT' for nested

Protobuf Objects

  * (ion) Upgrade 'ion-java' to 1.11.10 (from 1.11.9)
  * Changes of 2.18.3
  * # 541: (cbor, protobuf, smile) 'SmileParser.getValueAsString()'

FIELD_NAME bug

  * Changes of 2.18.1
  * # 518: Should not read past end for CBOR string values

  * Changes of 2.18.0
  * # 167: (avro) Incompatibility with Avro >=1.9.0 (upgrade to

Avro 1.11.3)

  * # 484: (protobuf) Rework synchronization in 'ProtobufMapper'

  * # 494: (avro) Avro Schema generation: allow mapping Java Enum

properties to Avro String values

  * # 508: (avro) Ignore 'specificData' field on serialization

  * # 509: IonValueMapper.builder() not implemented, does not

register modules

  * (ion) Upgrade 'ion-java' to 1.11.9 (from 1.11.8) value

Changes for jackson-modules-base:

  * Upgrade to 2.18.8
  * No changes since 2.18.0
  * Changes of 2.18.0
  * # 233: (jaxb) Tolerate JAX-RS 2.2 in

jackson-module-jaxb-annotations so that it can be deployed in Liberty alongside
features which use 2.2

  * # 248: (android-record) jClass annotations and polymorphic

types are ignored when deserializing Android Record fields

  * # 251: (android-record) Constructor is not recognized when a

record uses both arrays and generic types

Changes for jackson-parent:

  * Update to 2.18.4
  * Changes of 2.18.4
  * Update to latest 'oss-parent' (69)
  * Changes of 2.18.3
  * Update to latest 'oss-parent' (68)
  * Switch to publishing via Sonatype Central Portal repo
  * Changes of 2.18.2
  * Update to latest 'oss-parent' (66); future-proof for Sonatype Central Portal
  * Changes of 2.18.1
  * # 15: Add override to downgrade 'moditect-maven-plugin' from

1.2.2 to 1.1.0 to work around Eclipse issues

  * Changes of 2.18
  * Update to oss-parent 61 (plugin version updates)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-2801=1

  * Development Tools Module 15-SP7  
    zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP7-2026-2801=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-2801=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP6  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2801=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP5  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-2801=1

  * Basesystem Module 15-SP7  
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-2801=1

  * SUSE Linux Enterprise Server 15 SP5 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-2801=1

  * SUSE Linux Enterprise Server 15 SP4 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-2801=1

  * SUSE Linux Enterprise Server 15 SP6 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2801=1

  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-2801=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-2801=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP4  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-2801=1

## Package List:

  * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * Basesystem Module 15-SP7 (noarch)
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-core-2.18.8-150200.3.22.3
  * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
    * jackson-annotations-2.18.8-150200.3.22.3
    * jackson-databind-2.18.8-150200.3.28.2
    * jackson-core-2.18.8-150200.3.22.3
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3
  * Development Tools Module 15-SP7 (noarch)
    * jackson-dataformat-cbor-2.18.8-150200.3.21.3

## References:

  * https://www.suse.com/security/cve/CVE-2026-54512.html
  * https://www.suse.com/security/cve/CVE-2026-54513.html
  * https://www.suse.com/security/cve/CVE-2026-54514.html
  * https://www.suse.com/security/cve/CVE-2026-54515.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1268603
  * https://bugzilla.suse.com/show_bug.cgi?id=1268897
  * https://bugzilla.suse.com/show_bug.cgi?id=1268898
  * https://bugzilla.suse.com/show_bug.cgi?id=1268899
  * https://bugzilla.suse.com/show_bug.cgi?id=1268902





Attachment: None (type=text/html)

(HTML attachment elided)
to post comments


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds