Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux packages using Jackson core can cause crash
published 1 year ago
Summary
The Jackson core library used in several AlmaLinux components can trigger a stack overflow, which may cause the application to stop working. This affects packages such as Apache Commons, BEA StAX API and other AlmaLinux libraries that rely on Jackson core. Update the affected packages to the latest version that includes the security fix.
What to do
- Update almalinux apache-commons-collections to version 3.2.2-10.module_el8.5.0+2577+9e95fe00.
- Update almalinux apache-commons-lang to version 2.6-21.module_el8.5.0+2577+9e95fe00.
- Update almalinux apache-commons-net to version 3.6-3.module_el8.5.0+2577+9e95fe00.
- Update almalinux bea-stax-api to version 1.2.0-16.module_el8.5.0+2577+9e95fe00.
- Update almalinux fasterxml-oss-parent to version 69-1.module_el8.10.0+4034+20822525.
- Update almalinux glassfish-fastinfoset to version 1.2.13-9.module_el8.5.0+2577+9e95fe00.
- Update almalinux glassfish-jaxb-api to version 2.2.12-8.module_el8.5.0+2577+9e95fe00.
- Update almalinux glassfish-jaxb-core to version 2.2.11-12.module_el8.10.0+3791+e0637953.
- Update almalinux glassfish-jaxb-runtime to version 2.2.11-12.module_el8.10.0+3791+e0637953.
- Update almalinux glassfish-jaxb-txw2 to version 2.2.11-12.module_el8.10.0+3791+e0637953.
- Update almalinux jackson-annotations to version 2.19.1-1.module_el8.10.0+4034+20822525.
- Update almalinux jackson-bom to version 2.19.1-1.module_el8.10.0+4034+20822525.
- Update almalinux jackson-core to version 2.19.1-1.module_el8.10.0+4034+20822525.
- Update almalinux jackson-databind to version 2.19.1-1.module_el8.10.0+4034+20822525.
- Update almalinux jackson-jaxrs-json-provider to version 2.19.1-1.module_el8.10.0+4034+20822525.
- Update almalinux jackson-jaxrs-providers to version 2.19.1-1.module_el8.10.0+4034+20822525.
- Update almalinux jackson-module-jaxb-annotations to version 2.19.1-1.module_el8.10.0+4034+20822525.
- Update almalinux jackson-modules-base to version 2.19.1-1.module_el8.10.0+4034+20822525.
- Update almalinux jackson-parent to version 2.19.1-1.module_el8.10.0+4034+20822525.
- Update almalinux jakarta-commons-httpclient to version 1:3.1-28.module_el8.5.0+2577+9e95fe00.
- Update almalinux javassist to version 3.18.1-8.module_el8.5.0+2577+9e95fe00.
- Update almalinux javassist-javadoc to version 3.18.1-8.module_el8.5.0+2577+9e95fe00.
- Update almalinux pki-servlet-engine to version 1:9.0.62-1.module_el8.10.0+3791+e0637953.
- Update almalinux relaxngdatatype to version 2011.1-7.module_el8.5.0+2577+9e95fe00.
- Update almalinux slf4j to version 1.7.25-4.module_el8.5.0+2577+9e95fe00.
- Update almalinux slf4j-jdk14 to version 1.7.25-4.module_el8.5.0+2577+9e95fe00.
- Update almalinux stax-ex to version 1.7.7-8.module_el8.5.0+2577+9e95fe00.
- Update almalinux velocity to version 1.7-24.module_el8.5.0+2577+9e95fe00.
- Update almalinux xalan-j2 to version 2.7.1-38.module_el8.5.0+2577+9e95fe00.
- Update almalinux xerces-j2 to version 2.11.0-34.module_el8.5.0+2577+9e95fe00.
- Update almalinux xml-commons-apis to version 1.4.01-25.module_el8.5.0+2577+9e95fe00.
- Update almalinux xml-commons-resolver to version 1.2-26.module_el8.5.0+2577+9e95fe00.
- Update almalinux xmlstreambuffer to version 1.5.4-8.module_el8.5.0+2577+9e95fe00.
- Update almalinux xsom to version 0-19.20110809svn.module_el8.5.0+2577+9e95fe00.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | apache-commons-collections |
< 3.2.2-10.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 3.2.2-10.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | apache-commons-lang |
< 2.6-21.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 2.6-21.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | apache-commons-net |
< 3.6-3.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 3.6-3.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | bea-stax-api |
< 1.2.0-16.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1.2.0-16.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | fasterxml-oss-parent |
< 69-1.module_el8.10.0+4034+20822525 Fix: upgrade to 69-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | glassfish-fastinfoset |
< 1.2.13-9.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1.2.13-9.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | glassfish-jaxb-api |
< 2.2.12-8.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 2.2.12-8.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | glassfish-jaxb-core |
< 2.2.11-12.module_el8.10.0+3791+e0637953 Fix: upgrade to 2.2.11-12.module_el8.10.0+3791+e0637953
|
| AlmaLinux:8 | almalinux | glassfish-jaxb-runtime |
< 2.2.11-12.module_el8.10.0+3791+e0637953 Fix: upgrade to 2.2.11-12.module_el8.10.0+3791+e0637953
|
| AlmaLinux:8 | almalinux | glassfish-jaxb-txw2 |
< 2.2.11-12.module_el8.10.0+3791+e0637953 Fix: upgrade to 2.2.11-12.module_el8.10.0+3791+e0637953
|
| AlmaLinux:8 | almalinux | jackson-annotations |
< 2.19.1-1.module_el8.10.0+4034+20822525 Fix: upgrade to 2.19.1-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | jackson-bom |
< 2.19.1-1.module_el8.10.0+4034+20822525 Fix: upgrade to 2.19.1-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | jackson-core |
< 2.19.1-1.module_el8.10.0+4034+20822525 Fix: upgrade to 2.19.1-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | jackson-databind |
< 2.19.1-1.module_el8.10.0+4034+20822525 Fix: upgrade to 2.19.1-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | jackson-jaxrs-json-provider |
< 2.19.1-1.module_el8.10.0+4034+20822525 Fix: upgrade to 2.19.1-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | jackson-jaxrs-providers |
< 2.19.1-1.module_el8.10.0+4034+20822525 Fix: upgrade to 2.19.1-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | jackson-module-jaxb-annotations |
< 2.19.1-1.module_el8.10.0+4034+20822525 Fix: upgrade to 2.19.1-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | jackson-modules-base |
< 2.19.1-1.module_el8.10.0+4034+20822525 Fix: upgrade to 2.19.1-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | jackson-parent |
< 2.19.1-1.module_el8.10.0+4034+20822525 Fix: upgrade to 2.19.1-1.module_el8.10.0+4034+20822525
|
| AlmaLinux:8 | almalinux | jakarta-commons-httpclient |
< 1:3.1-28.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1:3.1-28.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | javassist |
< 3.18.1-8.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 3.18.1-8.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | javassist-javadoc |
< 3.18.1-8.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 3.18.1-8.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | pki-servlet-engine |
< 1:9.0.62-1.module_el8.10.0+3791+e0637953 Fix: upgrade to 1:9.0.62-1.module_el8.10.0+3791+e0637953
|
| AlmaLinux:8 | almalinux | relaxngdatatype |
< 2011.1-7.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 2011.1-7.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | slf4j |
< 1.7.25-4.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1.7.25-4.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | slf4j-jdk14 |
< 1.7.25-4.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1.7.25-4.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | stax-ex |
< 1.7.7-8.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1.7.7-8.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | velocity |
< 1.7-24.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1.7-24.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | xalan-j2 |
< 2.7.1-38.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 2.7.1-38.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | xerces-j2 |
< 2.11.0-34.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 2.11.0-34.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | xml-commons-apis |
< 1.4.01-25.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1.4.01-25.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | xml-commons-resolver |
< 1.2-26.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1.2-26.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | xmlstreambuffer |
< 1.5.4-8.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 1.5.4-8.module_el8.5.0+2577+9e95fe00
|
| AlmaLinux:8 | almalinux | xsom |
< 0-19.20110809svn.module_el8.5.0+2577+9e95fe00 Fix: upgrade to 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
|
Original advisory text
Important: pki-deps:10.6 security update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System.
Security Fix(es):
* com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2025:14126 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-52999 Third Party Advisory
- https://bugzilla.redhat.com/2374804 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2025-14126.html Vendor Advisory
Timeline
Published20 Aug 2025
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2025:14126 · OSV
Track software like this
Free during beta