Skip to content
VulniPulse
Sign in
Advisory severityHigh7.5Red Hat Linux

High [CVE-2026-68498] Denial of Service via excessively long JSON property names

This high-severity Red Hat Linux advisory covers CVE-2026-68498; related products: Exploit Intelligence, OpenShift Developer Tools and Services, OpenShift Serverless.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-68498 Source published Source updated

VulniPulse record published Record updated

CVE-2026-68498
Related products & platforms
Red Hat LinuxRed Hat Enterprise Linux
Open source advisory

Get an email when Red Hat Linux RHEL & SELinux publishes the next one.

See Red Hat Linux RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Red Hat Linux RHEL & SELinux

Summary

Denial of Service via excessively long JSON property names. Red Hat rates this important (CVSS 7.5).

Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:88156 with package ocp-tools-4/jenkins-rhel8:1792044386, ocp-tools-4/jenkins-rhel9:1792040096, ocp-tools-4/jenkins-rhel9:1792040287, ocp-tools-4/jenkins-rhel9:1792040131.

Affected products named by the advisory: Exploit Intelligence; OpenShift Developer Tools and Services; OpenShift Serverless; Red Hat AI Inference Server; and 20 more.

Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat Ansible Automation Platform 2; Red Hat build of Apache Camel for Spring Boot 4; Red Hat build of Apache Camel - HawtIO 4; and 16 more.

Affected versions
  • < 2.16.0
  • 3.0.0

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Fixed versions
  • ocp-tools-4/jenkins-rhel8:1792044386
  • ocp-tools-4/jenkins-rhel9:1792040096
  • ocp-tools-4/jenkins-rhel9:1792040287
  • ocp-tools-4/jenkins-rhel9:1792040131
  • ocp-tools-4/jenkins-rhel8:1792044327
  • ocp-tools-4/jenkins-rhel8:1792044326
  • ocp-tools-4/jenkins-rhel8:1792044382
  • ocp-tools-4/jenkins-rhel9:1792040081
  • pki-deps:10.6-8100020261021095739.489197e6
  • ocp-tools-4/jenkins-rhel9:1792040428
  • ocp-tools-4/jenkins-rhel9:1792040733
  • ocp-tools-4/jenkins-rhel9:1792041514
  • RHSA-2026:88156

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

More Red Hat Linux advisories

All Red Hat Linux advisories

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alertsSee app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.