High7.5Red Hat Linux
High [CVE-2026-55223] Remote code execution via deserialization vulnerability
This high-severity Red Hat Linux advisory covers CVE-2026-55223.
CVE-2026-55223 Published Jun 30, 2026Updated by vendor Jun 30, 2026
Affected products & platforms
Red Hat LinuxUnclassified
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Matching phone alertsOptional email delivery
Summary
Remote code execution via deserialization vulnerability. Red Hat rates this important (CVSS 7.5).
Weakness: CWE-502.
Affected versions
- < 0.14.0
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
Mitigation checklist
Recommended fix / mitigation
- Any of the following can reduce the risk or render exploitation not-feasible: - Run applications on Java 16 or later, which restricts reflective access and partially blocks the JavaBean property lookup step of the attack chain. - Remove Apache Commons BeanUtils from the classpath if it is not required, eliminating the most common deserialization carrier. - Ensure the application does not deserialize untrusted input from network sources. Red Hat recommends updating c3p0 to version 0.14.0 or later when a fix is available, which adds explicit BeanInfo classes to exclude the dangerous properties from JavaBean introspection.
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.