{"schema":"vulnpedia.research/1","cve":"CVE-2026-68498","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99","tags":["vendor-advisory","vendor-reference"],"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","origins":[{"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99"},{"source":"nvd","sourceId":"CVE-2026-68498","modified":"2026-10-20T19:17:40.120","url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99"},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99"}]},{"url":"https://github.com/FasterXML/jackson-core/pull/1643","tags":["patch","vendor-reference"],"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","origins":[{"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","url":"https://github.com/FasterXML/jackson-core/pull/1643"},{"source":"nvd","sourceId":"CVE-2026-68498","modified":"2026-10-20T19:17:40.120","url":"https://github.com/FasterXML/jackson-core/pull/1643"},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://github.com/FasterXML/jackson-core/pull/1643"}]},{"url":"https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075","tags":["patch","vendor-reference"],"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","origins":[{"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","url":"https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075"},{"source":"nvd","sourceId":"CVE-2026-68498","modified":"2026-10-20T19:17:40.120","url":"https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075"},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075"}]},{"url":"https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x","tags":["release-notes","vendor-reference"],"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","origins":[{"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","url":"https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x"},{"source":"nvd","sourceId":"CVE-2026-68498","modified":"2026-10-20T19:17:40.120","url":"https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x"},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x"}]},{"url":"https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION","tags":["release-notes","vendor-reference"],"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","origins":[{"source":"mitre","sourceId":"HeroDevs","modified":"2026-10-16T21:11:03.551Z","url":"https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION"},{"source":"nvd","sourceId":"CVE-2026-68498","modified":"2026-10-20T19:17:40.120","url":"https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION"},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-68498","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-68498"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554486","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554486"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68498","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-68498"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68498","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68498"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88152","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88152"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88151","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88151"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88150","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88150"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88156","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88156"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88159","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88159"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88153","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88153"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88158","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88158"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88157","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88157"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88155","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88155"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88154","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88154"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88149","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88149"}]},{"source":"euvd","sourceId":"EUVD-2026-103177","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103177","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-103177","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103177"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:96e5820b8b83bde089b7449a089d66be83f42cedf407ee0803ef26a545544fde_amd64","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:96e5820b8b83bde089b7449a089d66be83f42cedf407ee0803ef26a545544fde_amd64 as a component of OpenShift Developer Tools and Services 4.12","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-12 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88152"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel8@sha256%3A96e5820b8b83bde089b7449a089d66be83f42cedf407ee0803ef26a545544fde?arch=amd64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8&tag=1792044326","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:c03355915f59dd67f6465e52586330f519ac97b9013ddc278867555ced2d9fac_amd64","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:c03355915f59dd67f6465e52586330f519ac97b9013ddc278867555ced2d9fac_amd64 as a component of OpenShift Developer Tools and Services 4.14","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-14 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88151"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel8@sha256%3Ac03355915f59dd67f6465e52586330f519ac97b9013ddc278867555ced2d9fac?arch=amd64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8&tag=1792044382","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:69b329adeb51d7cfa805dd9431c53965e2dca0b12481312182307aa6e6b0f74f_amd64","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:69b329adeb51d7cfa805dd9431c53965e2dca0b12481312182307aa6e6b0f74f_amd64 as a component of OpenShift Developer Tools and Services 4.15","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-15 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88150"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel8@sha256%3A69b329adeb51d7cfa805dd9431c53965e2dca0b12481312182307aa6e6b0f74f?arch=amd64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8&tag=1792044386","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6df696cfde5dd9e20e654da5f1c68c0e9784545830702943cb48d5510109a6ad_amd64","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6df696cfde5dd9e20e654da5f1c68c0e9784545830702943cb48d5510109a6ad_amd64 as a component of OpenShift Developer Tools and Services 4.16","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-16 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88156"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel9@sha256%3A6df696cfde5dd9e20e654da5f1c68c0e9784545830702943cb48d5510109a6ad?arch=amd64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9&tag=1792040287","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:384dab79ba9ac7e7b3ddfdc1733f75c578d89df108e844e3e6167df1b40d0908_s390x","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:384dab79ba9ac7e7b3ddfdc1733f75c578d89df108e844e3e6167df1b40d0908_s390x as a component of OpenShift Developer Tools and Services 4.17","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-17 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88159"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel9@sha256%3A384dab79ba9ac7e7b3ddfdc1733f75c578d89df108e844e3e6167df1b40d0908?arch=s390x&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9&tag=1792040131","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:44cb8767b56b3b59944600ec9b14e760a82ae7b652071a4a14e58b0269372823_arm64","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:44cb8767b56b3b59944600ec9b14e760a82ae7b652071a4a14e58b0269372823_arm64 as a component of OpenShift Developer Tools and Services 4.18","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-18 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88153"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel9@sha256%3A44cb8767b56b3b59944600ec9b14e760a82ae7b652071a4a14e58b0269372823?arch=arm64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9&tag=1792041514","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:1ad906acf8a1ea05a5c45c54b28bf2329daeee0eb7e0556a3de2fa3453446b62_s390x","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:1ad906acf8a1ea05a5c45c54b28bf2329daeee0eb7e0556a3de2fa3453446b62_s390x as a component of OpenShift Developer Tools and Services 4.19","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-19 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88158"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel9@sha256%3A1ad906acf8a1ea05a5c45c54b28bf2329daeee0eb7e0556a3de2fa3453446b62?arch=s390x&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9&tag=1792040733","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:4e2befa4cba56ae02abb56959b7f4a3a214a249e811664e05bee87fe31b2e2a7_amd64","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:4e2befa4cba56ae02abb56959b7f4a3a214a249e811664e05bee87fe31b2e2a7_amd64 as a component of OpenShift Developer Tools and Services 4.20","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-20 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88157"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel9@sha256%3A4e2befa4cba56ae02abb56959b7f4a3a214a249e811664e05bee87fe31b2e2a7?arch=amd64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9&tag=1792040081","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:2a2edf64b175bb295e3544569a411280542ae4e1fa2e75b4cf09c5677a6d953e_amd64","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:2a2edf64b175bb295e3544569a411280542ae4e1fa2e75b4cf09c5677a6d953e_amd64 as a component of OpenShift Developer Tools and Services 4.21","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-21 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88155"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel9@sha256%3A2a2edf64b175bb295e3544569a411280542ae4e1fa2e75b4cf09c5677a6d953e?arch=amd64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9&tag=1792040096","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a94fd5fd4c7413638612e2368e7f8fe0d9764fa5ad99076fa3fd518f31116a87_s390x","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a94fd5fd4c7413638612e2368e7f8fe0d9764fa5ad99076fa3fd518f31116a87_s390x as a component of OpenShift Developer Tools and Services 4.21","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-21 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88155"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel9@sha256%3Aa94fd5fd4c7413638612e2368e7f8fe0d9764fa5ad99076fa3fd518f31116a87?arch=s390x&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9&tag=1792040096","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:ef118575732160d296d2e73ca99a292a3559c512d6bde90ff1804eec3fb89a49_amd64","product":"registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:ef118575732160d296d2e73ca99a292a3559c512d6bde90ff1804eec3fb89a49_amd64 as a component of OpenShift Developer Tools and Services 4.22","status":"fixed","remediations":[{"category":"vendor_fix","details":"It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-22 upgrade to the latest.","url":"https://access.redhat.com/errata/RHSA-2026:88154"},{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}],"purl":"pkg:oci/jenkins-rhel9@sha256%3Aef118575732160d296d2e73ca99a292a3559c512d6bde90ff1804eec3fb89a49?arch=amd64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9&tag=1792040428","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"exploit_intelligence:exploit-intelligence/agent-client-rhel9","product":"exploit-intelligence/agent-client-rhel9 as a component of Exploit Intelligence","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/agent-client-rhel9?repository_url=registry.redhat.io/exploit-intelligence/agent-client-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","product":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 as a component of OpenShift Serverless","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/kn-eventing-integrations-aws-sqs-sink-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_ai_inference_server:rhaii/vllm-gaudi-rhel9","product":"rhaii/vllm-gaudi-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/vllm-gaudi-rhel9?repository_url=registry.redhat.io/rhaii/vllm-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_ansible_automation_platform_2:python3.12-drools-jpy-jar.src","product":"python3.12-drools-jpy-jar.src as a component of Red Hat Ansible Automation Platform 2","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/python3.12-drools-jpy-jar?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_build_of_keycloak:rhbk/keycloak-rhel9","product":"rhbk/keycloak-rhel9 as a component of Red Hat Build of Keycloak","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/keycloak-rhel9?repository_url=registry.redhat.io/rhbk/keycloak-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_enterprise_linux_8:jackson-core::pki-deps:10.6","product":"jackson-core (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/jackson-core?rpmmod=pki-deps:10.6","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_fuse_7:jackson-core","product":"jackson-core as a component of Red Hat Fuse 7","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_offline_knowledge_portal:offline-knowledge-portal/rhokp-rhel9","product":"offline-knowledge-portal/rhokp-rhel9 as a component of Red Hat Offline Knowledge Portal","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/rhokp-rhel9?repository_url=registry.redhat.io/offline-knowledge-portal/rhokp-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th-torch-cuda-py312-rhel9","product":"rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-th-torch-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-trustyai-service-rhel9","product":"rhoai/odh-trustyai-service-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-trustyai-service-rhel9?repository_url=registry.redhat.io/rhoai/odh-trustyai-service-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_single_sign-on_7:jackson-core","product":"jackson-core as a component of Red Hat Single Sign-On 7","status":"known_affected","remediations":[{"category":"workaround","details":"Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:fb0f2ae78c1ed7aebc2a6af8eb3c0a5360513010bed7e9138b99b231ef2c384a_amd64","product":"registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:fb0f2ae78c1ed7aebc2a6af8eb3c0a5360513010bed7e9138b99b231ef2c384a_amd64 as a component of OpenShift Developer Tools and Services 4.12","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/jenkins-agent-base-rhel8@sha256%3Afb0f2ae78c1ed7aebc2a6af8eb3c0a5360513010bed7e9138b99b231ef2c384a?arch=amd64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8&tag=1792044376","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:72ccaa83007b4ccb6597f09a4444703552071e41fb66fd84738c132b9bdd072f_arm64","product":"registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:72ccaa83007b4ccb6597f09a4444703552071e41fb66fd84738c132b9bdd072f_arm64 as a component of OpenShift Developer Tools and Services 4.17","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/jenkins-agent-base-rhel9@sha256%3A72ccaa83007b4ccb6597f09a4444703552071e41fb66fd84738c132b9bdd072f?arch=arm64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9&tag=1792040149","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:139c02c73fa169816e2ad7884b5f27ecc325b5ebe7e36f34085950fd04a89b58_amd64","product":"registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:139c02c73fa169816e2ad7884b5f27ecc325b5ebe7e36f34085950fd04a89b58_amd64 as a component of OpenShift Developer Tools and Services 4.22","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/jenkins-agent-base-rhel9@sha256%3A139c02c73fa169816e2ad7884b5f27ecc325b5ebe7e36f34085950fd04a89b58?arch=amd64&repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9&tag=1792040297","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_ceph_storage_7:liborc1","product":"liborc1 as a component of Red Hat Ceph Storage 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/liborc1","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_enterprise_linux_10:idm-pki-tools","product":"idm-pki-tools as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/idm-pki-tools","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_enterprise_linux_8:jss.src::pki-core:10.6","product":"jss.src (pki-core:10.6) as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jss?arch=src&rpmmod=pki-core:10.6","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_enterprise_linux_8:protobuf-lite","product":"protobuf-lite as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/protobuf-lite","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_enterprise_linux_9:idm-pki-server","product":"idm-pki-server as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/idm-pki-server","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_enterprise_linux_9:python3-idm-pki","product":"python3-idm-pki as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/python3-idm-pki","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]},{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","productId":"red_hat_satellite_6:openvox-server.src","product":"openvox-server.src as a component of Red Hat Satellite 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/openvox-server?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-68498","modified":"2026-10-23T17:23:20+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"}]}],"vendorCoverage":{"total":239,"shown":32,"omitted":207,"source":"redhat"}}