Pki-Deps:10.6 Security Update — AlmaLinux 8 (ALSA-2026:90909)

ALSA-2026:90909 updates the PKI Core packages on AlmaLinux 8, fixing three CVEs in the Jackson-core JSON library: denial-of-service via deep or malformed JSON (CVE-2026-89425, CVE-2026-91777) and a third Jackson flaw (CVE-2026-68498), aggregate CVSS 7.5 (CWE-400 resource exhaustion). Update with dnf update pki-core (or the pki-deps:10.6 module) on servers running Red Hat Certificate System / Dogtag PKI.

High 7.5 CVSS 2026-10-29

AlmaLinux 8

Betroffene Versionen

10.6

Was das unter einer SharedLicense-Lizenz bedeutet

Jackson parses JSON on behalf of the certificate infrastructure — crafted JSON can exhaust resources and take down the PKI services that issue and validate the certificates other systems trust.

Type:

security

Severity:

important

Release date:

2026-10-29

Description:

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

Security Fix(es):

* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)
* com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
noarch	Packages/xmlstreambuffer-1.5.4-8.module_el8.5.0+2577+9e95fe00.noarch.rpm	05648f42fce41f399dfe350b66a8b0e8f403b21ba77f3288ec612c6f7575b5ca
noarch	Packages/jakarta-commons-httpclient-3.1-28.module_el8.5.0+2577+9e95fe00.noarch.rpm	10bd8b35a7627089633a2b991411dbde04fc44bce205e99a070803b525ac27a8
noarch	jackson-databind-2.21.4-1.module_el8.10.0+4329+908ad137.1.noarch.rpm	1ebe223a2debd05c48a8bb8509cc0f95804aa0a92e8f6c5f34aa7124d08a60e6
noarch	jackson-annotations-2.21-1.module_el8.10.0+4235+0924958e.noarch.rpm	202e7c95c36b58cc04f5b2f86b1f1acfad53e4693a6b70a91780fcede168ef8b
noarch	Packages/relaxngDatatype-2011.1-7.module_el8.5.0+2577+9e95fe00.noarch.rpm	33ef1dca728f64a392ffadafb9a0ca9d0b5d6ac4e6482b99206cda2c92c97d12
noarch	Packages/apache-commons-collections-3.2.2-10.module_el8.5.0+2577+9e95fe00.noarch.rpm	3cfda9d7dd99102c7b29705a732b41950cf92f90078f7555fc253989bc0782a0
noarch	Packages/javassist-3.18.1-8.module_el8.5.0+2577+9e95fe00.noarch.rpm	432ef2e90a105aa946ad452af5ad9f13004ac3a8ab7647254cad7a4dbd433554
noarch	Packages/xml-commons-resolver-1.2-26.module_el8.5.0+2577+9e95fe00.noarch.rpm	4649adc067659e2a6078eb08f1686d9cbc2a8810277009d801b256853d83186b
noarch	glassfish-jaxb-core-2.2.11-12.module_el8.10.0+3791+e0637953.noarch.rpm	477a47687a21585315f4689a51288631d5fbac847b6673fba9f274890712a70a
noarch	pki-servlet-engine-9.0.62-1.module_el8.10.0+3791+e0637953.noarch.rpm	532c855c94c4c589650554fdca9b4a4273dbb7c39b9840babd880c237ced690c
noarch	Packages/xerces-j2-2.11.0-34.module_el8.5.0+2577+9e95fe00.noarch.rpm	553918f29e8ed7083f15f8f6b1630abb1d99dd32197a81f8aa15f6bedb2b30f4
noarch	Packages/velocity-1.7-24.module_el8.5.0+2577+9e95fe00.noarch.rpm	5a6eee4a0135a0538b924361376c7a22936d4c43dec3defb83eed5b3bb1e2897
noarch	Packages/xalan-j2-2.7.1-38.module_el8.5.0+2577+9e95fe00.noarch.rpm	5e01e9a7a21bd38e4949ec1366498734538cdb68e247e8d88bdaf0ef50802941
noarch	Packages/slf4j-jdk14-1.7.25-4.module_el8.5.0+2577+9e95fe00.noarch.rpm	5f436c322a1b3aad14621f8b6e6bec715184284b492c3ff60591f0d8bec3ffde
noarch	glassfish-jaxb-txw2-2.2.11-12.module_el8.10.0+3791+e0637953.noarch.rpm	6a6d9268a508987cc0336c3494e5657095dba3e655f1225b7fa7128dc097887f
noarch	Packages/bea-stax-api-1.2.0-16.module_el8.5.0+2577+9e95fe00.noarch.rpm	6d944b415c59e5519365c59135ffef18839255c479277d2701d01e0500192256
noarch	glassfish-jaxb-runtime-2.2.11-12.module_el8.10.0+3791+e0637953.noarch.rpm	7eeafc54dba1be4f10984f2ad8dd2430740d7c134a735d41d95eb83becf36033
noarch	Packages/xml-commons-apis-1.4.01-25.module_el8.5.0+2577+9e95fe00.noarch.rpm	8b391528f92eddaaf0a0dc3f634718c438659c3f97dd0d7d7131ce9d8090be64
noarch	jackson-core-2.21.4-1.module_el8.10.0+4329+908ad137.3.noarch.rpm	8e2313ade64ddf10a98fae0be7ca62dbfb1fd941933b60b41dd6a404b0fe6f53
noarch	jackson-jaxrs-json-provider-2.21.4-1.module_el8.10.0+4235+0924958e.noarch.rpm	985a88b5d98d73b2a7267e172b80a60a660b2fd60206670bd6e7478c133f8058
noarch	jackson-jaxrs-providers-2.21.4-1.module_el8.10.0+4235+0924958e.noarch.rpm	a2df5f90f097e77f2d72ac4444080052dd10046f6cb8c1ea84e4c39bb9acc806
noarch	Packages/glassfish-fastinfoset-1.2.13-9.module_el8.5.0+2577+9e95fe00.noarch.rpm	b5cab09d52a8dc6754f3b7bc81d80d8dc4478417ca882c36785c2cc6a9253ce3
noarch	Packages/glassfish-jaxb-api-2.2.12-8.module_el8.5.0+2577+9e95fe00.noarch.rpm	beb7a887367ef8539a8eb20d5a62e1351577f84cc665b8f955d2cf96b5780024
noarch	Packages/slf4j-1.7.25-4.module_el8.5.0+2577+9e95fe00.noarch.rpm	c109b72a68915ed0cf53730c115d81ce088f19ac2582206dff3642c5076b3f17
noarch	Packages/apache-commons-lang-2.6-21.module_el8.5.0+2577+9e95fe00.noarch.rpm	c1cbb22cc5abd53350cd3fd27187e0c988d3872f91ec160039b3ad02565d2b50
noarch	Packages/apache-commons-net-3.6-3.module_el8.5.0+2577+9e95fe00.noarch.rpm	ca766bb12ea0913e34efd576f86e1d24cf3583f9c2b403135af543a61d8e81ea
noarch	Packages/javassist-javadoc-3.18.1-8.module_el8.5.0+2577+9e95fe00.noarch.rpm	d07761752107a818daea7ef556c2681fd35efa739687f7942f851ffc835dedb1
noarch	Packages/xsom-0-19.20110809svn.module_el8.5.0+2577+9e95fe00.noarch.rpm	d373cee4cbd659168ea847d6d2d6429859b6d8c9c41877d6d25a93b30cc2362a
noarch	jackson-module-jaxb-annotations-2.21.4-2.module_el8.10.0+4235+0924958e.noarch.rpm	dd8d05152348807c92f9091b8f888ed8f4401fc4075f99e57d201ac31564aa07
noarch	Packages/stax-ex-1.7.7-8.module_el8.5.0+2577+9e95fe00.noarch.rpm	df93c43fcc001714d329e6035685b00548226c69384543a54f57a08a53a4fdd2

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is ALSA-2026:90909?

It is AlmaLinux's erratum for the pki-deps:10.6 module (PKI Core and its Jackson JSON dependencies), fixing CVE-2026-89425, CVE-2026-91777 and CVE-2026-68498 — Jackson-core denial-of-service flaws, aggregate CVSS 7.5 (CWE-400).

Who is affected?

AlmaLinux 8 servers running Red Hat Certificate System / Dogtag PKI — certificate authorities and registration authorities. Servers without PKI installed are unaffected.

How do I apply the fix?

Run dnf update within the pki-deps:10.6 module (or dnf update pki-base pki-server and related packages), then restart the PKI services.

Why does a JSON library update matter for a certificate authority?

PKI services expose JSON APIs for enrollment and management — Jackson parses that input, so a resource-exhaustion flaw there is a direct denial-of-service path against your certificate infrastructure.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen