CLEANSTART-2026-HF71124

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HF71124.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2026-HF71124
Upstream
Published
2026-11-13T00:37:27Z
Modified
2026-11-13T00:45:02Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...
Details

CVE-2026-110879 affects multiple packages. jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. See references for individual vulnerability details.

References

Affected packages

CleanStart
wso2am

Package

Name
wso2am
Purl
pkg:apk/cleanstart/wso2am

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.7.0-r5

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HF71124.json"
rundeck

Package

Name
rundeck
Purl
pkg:apk/cleanstart/rundeck

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.0.1-r11

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HF71124.json"
strimzi-kafka-operator

Package

Name
strimzi-kafka-operator
Purl
pkg:apk/cleanstart/strimzi-kafka-operator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.2.0-r6

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HF71124.json"
wso2mi

Package

Name
wso2mi
Purl
pkg:apk/cleanstart/wso2mi?arch=noarch

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.6.0-r9

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HF71124.json"
strimzi-kafka-operator

Package

Name
strimzi-kafka-operator
Purl
pkg:apk/cleanstart/strimzi-kafka-operator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.51.0-r8

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HF71124.json"
solr

Package

Name
solr
Purl
pkg:apk/cleanstart/solr

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.11.0-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-HF71124.json"