# CVE-2026-68498: jackson-core: StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Ob...

CVE-2026-68498 is fixed in 35 products on 1 platform, first by SUSE-SU-2026:4394-1, released September 29, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-68498
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0065
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 29, 2026

## Description

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.    In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.    A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.    Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.    This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | apache-commons-collections RHEL 8 | 0:3.2.2-10.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | apache-commons-collections almalinux 8 | 3.2.2-10.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | apache-commons-collections ol 8 | 0:3.2.2-10.module+el8.10.0+90642+1ede0e5a | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | apache-commons-collections rocky 8 | 0:3.2.2-10.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | apache-commons-lang RHEL 8 | 0:2.6-21.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | apache-commons-lang almalinux 8 | 2.6-21.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | apache-commons-lang ol 8 | 0:2.6-21.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | apache-commons-lang rocky 8 | 0:2.6-21.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | apache-commons-net RHEL 8 | 0:3.6-3.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | apache-commons-net almalinux 8 | 3.6-3.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | apache-commons-net ol 8 | 0:3.6-3.module+el8.10.0+90642+1ede0e5a | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | apache-commons-net rocky 8 | 0:3.6-3.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | bea-stax rocky 8 | 0:1.2.0-16.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | bea-stax-api RHEL 8 | 0:1.2.0-16.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | bea-stax-api almalinux 8 | 1.2.0-16.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | bea-stax-api ol 8 | 0:1.2.0-16.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-fastinfoset RHEL 8 | 0:1.2.13-9.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | glassfish-fastinfoset almalinux 8 | 1.2.13-9.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-fastinfoset ol 8 | 0:1.2.13-9.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-fastinfoset rocky 8 | 0:1.2.13-9.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb rocky 8 | 0:2.2.11-12.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb-api RHEL 8 | 0:2.2.12-8.module+el8.10.0+21035+a01f6469 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | glassfish-jaxb-api almalinux 8 | 2.2.12-8.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb-api ol 8 | 0:2.2.12-8.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb-api rocky 8 | 0:2.2.12-8.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb-core RHEL 8 | 0:2.2.11-12.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | glassfish-jaxb-core almalinux 8 | 2.2.11-12.module_el8.10.0+3791+e0637953 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb-core ol 8 | 0:2.2.11-12.module+el8.10.0+90642+1ede0e5a | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb-runtime RHEL 8 | 0:2.2.11-12.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | glassfish-jaxb-runtime almalinux 8 | 2.2.11-12.module_el8.10.0+3791+e0637953 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb-runtime ol 8 | 0:2.2.11-12.module+el8.10.0+90642+1ede0e5a | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb-txw2 RHEL 8 | 0:2.2.11-12.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | glassfish-jaxb-txw2 almalinux 8 | 2.2.11-12.module_el8.10.0+3791+e0637953 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | glassfish-jaxb-txw2 ol 8 | 0:2.2.11-12.module+el8.10.0+90642+1ede0e5a | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-annotations RHEL 8 | 0:2.21-1.module+el8.10.0+24523+f75fb079 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | jackson-annotations almalinux 8 | 2.21-1.module_el8.10.0+4235+0924958e | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-annotations ol 8 | 0:2.21-1.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-annotations opensuse-leap 16.0 | 2.18.11-160000.1.1 | [OPENSUSE-SU-2026:22034-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22034-1.md) | Oct 6, 2026 |
| Linux | jackson-annotations rocky 8 | 0:2.21-1.module+el8.10.0+40260+021059e6 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-annotations sles 15.6 | 2.18.11-150200.3.28.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-annotations sles 15.7 | 2.18.11-150200.3.28.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-annotations sles 16.0 | 2.18.11-160000.1.1 | [SUSE-SU-2026:24149-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24149-1.md) | Oct 6, 2026 |
| Linux | jackson-core Debian 14 | 2.18.11-1 | [DEBIAN-CVE-2026-68498](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68498.md) | Oct 20, 2026 |
| Linux | jackson-core RHEL 8 | 0:2.21.4-1.module+el8.10.0+25128+a2644b4c.3 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | jackson-core almalinux 8 | 2.21.4-1.module_el8.10.0+4329+908ad137.3 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-core ol 8 | 0:2.21.4-1.module+el8.10.0+91095+797d7a50.3 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-core opensuse-leap 16.0 | 2.18.11-160000.1.1 | [OPENSUSE-SU-2026:22034-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22034-1.md) | Oct 6, 2026 |
| Linux | jackson-core rocky 8 | 0:2.21.4-1.module+el8.10.0+40260+021059e6 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-core sles 15.6 | 2.18.11-150200.3.30.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-core sles 15.7 | 2.18.11-150200.3.30.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-core sles 16.0 | 2.18.11-160000.1.1 | [SUSE-SU-2026:24149-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24149-1.md) | Oct 6, 2026 |
| Linux | jackson-databind RHEL 8 | 0:2.21.4-1.module+el8.10.0+25128+a2644b4c.1 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | jackson-databind almalinux 8 | 2.21.4-1.module_el8.10.0+4329+908ad137.1 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-databind ol 8 | 0:2.21.4-1.module+el8.10.0+91095+797d7a50.1 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-databind opensuse-leap 16.0 | 2.18.11-160000.1.1 | [OPENSUSE-SU-2026:22034-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22034-1.md) | Oct 6, 2026 |
| Linux | jackson-databind rocky 8 | 0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-databind sles 15.6 | 2.18.11-150200.3.36.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-databind sles 15.7 | 2.18.11-150200.3.36.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-databind sles 16.0 | 2.18.11-160000.1.1 | [SUSE-SU-2026:24149-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24149-1.md) | Oct 6, 2026 |
| Linux | jackson-dataformat-xml sles 15.6 | 2.18.11-150200.5.8.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-dataformat-xml sles 15.7 | 2.18.11-150200.5.8.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-dataformats-binary sles 15.6 | 2.18.11-150200.3.29.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-dataformats-binary sles 15.7 | 2.18.11-150200.3.29.1 | [SUSE-SU-2026:4394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4394-1.md) | Sep 29, 2026 |
| Linux | jackson-jaxrs-json-provider RHEL 8 | 0:2.21.4-1.module+el8.10.0+24523+f75fb079 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | jackson-jaxrs-json-provider almalinux 8 | 2.21.4-1.module_el8.10.0+4235+0924958e | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-jaxrs-json-provider ol 8 | 0:2.21.4-1.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-jaxrs-providers RHEL 8 | 0:2.21.4-1.module+el8.10.0+24523+f75fb079 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | jackson-jaxrs-providers almalinux 8 | 2.21.4-1.module_el8.10.0+4235+0924958e | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-jaxrs-providers ol 8 | 0:2.21.4-1.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-jaxrs-providers rocky 8 | 0:2.21.4-1.module+el8.10.0+40260+021059e6 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-module-jaxb-annotations RHEL 8 | 0:2.21.4-2.module+el8.10.0+24523+f75fb079 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | jackson-module-jaxb-annotations almalinux 8 | 2.21.4-2.module_el8.10.0+4235+0924958e | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-module-jaxb-annotations ol 8 | 0:2.21.4-2.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jackson-modules-base rocky 8 | 0:2.21.4-2.module+el8.10.0+40260+021059e6 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jakarta-commons-httpclient RHEL 8 | 1:3.1-28.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | jakarta-commons-httpclient almalinux 8 | 1:3.1-28.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jakarta-commons-httpclient ol 8 | 1:3.1-28.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | jakarta-commons-httpclient rocky 8 | 1:3.1-28.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | javassist RHEL 8 | 0:3.18.1-8.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | javassist almalinux 8 | 3.18.1-8.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | javassist ol 8 | 0:3.18.1-8.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | javassist rocky 8 | 0:3.18.1-8.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | javassist-javadoc RHEL 8 | 0:3.18.1-8.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | javassist-javadoc almalinux 8 | 3.18.1-8.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | javassist-javadoc ol 8 | 0:3.18.1-8.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | pki-servlet-engine RHEL 8 | 1:9.0.62-1.module+el8.10.0+21257+2b5308b5 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | pki-servlet-engine almalinux 8 | 1:9.0.62-1.module_el8.10.0+3791+e0637953 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | pki-servlet-engine ol 8 | 1:9.0.62-1.module+el8.10.0+90642+1ede0e5a | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | pki-servlet-engine rocky 8 | 1:9.0.62-1.module+el8.10.0+1767+f923f786 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | relaxngDatatype RHEL 8 | 0:2011.1-7.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | relaxngDatatype almalinux 8 | 2011.1-7.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | relaxngDatatype ol 8 | 0:2011.1-7.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | relaxngDatatype rocky 8 | 0:2011.1-7.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | slf4j RHEL 8 | 0:1.7.25-4.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | slf4j almalinux 8 | 1.7.25-4.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | slf4j ol 8 | 0:1.7.25-4.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | slf4j rocky 8 | 0:1.7.25-4.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | slf4j-jdk14 RHEL 8 | 0:1.7.25-4.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | slf4j-jdk14 almalinux 8 | 1.7.25-4.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | slf4j-jdk14 ol 8 | 0:1.7.25-4.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | stax-ex RHEL 8 | 0:1.7.7-8.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | stax-ex almalinux 8 | 1.7.7-8.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | stax-ex ol 8 | 0:1.7.7-8.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | stax-ex rocky 8 | 0:1.7.7-8.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | velocity RHEL 8 | 0:1.7-24.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | velocity almalinux 8 | 1.7-24.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | velocity ol 8 | 0:1.7-24.module+el8.10.0+90642+1ede0e5a | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | velocity rocky 8 | 0:1.7-24.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xalan-j2 RHEL 8 | 0:2.7.1-38.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | xalan-j2 almalinux 8 | 2.7.1-38.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xalan-j2 ol 8 | 0:2.7.1-38.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xalan-j2 rocky 8 | 0:2.7.1-38.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xerces-j2 RHEL 8 | 0:2.11.0-34.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | xerces-j2 almalinux 8 | 2.11.0-34.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xerces-j2 ol 8 | 0:2.11.0-34.module+el8.10.0+90642+1ede0e5a | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xerces-j2 rocky 8 | 0:2.11.0-34.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xml-commons-apis RHEL 8 | 0:1.4.01-25.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | xml-commons-apis almalinux 8 | 1.4.01-25.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xml-commons-apis ol 8 | 0:1.4.01-25.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xml-commons-apis rocky 8 | 0:1.4.01-25.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xml-commons-resolver RHEL 8 | 0:1.2-26.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | xml-commons-resolver almalinux 8 | 1.2-26.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xml-commons-resolver ol 8 | 0:1.2-26.module+el8.10.0+90642+1ede0e5a | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xml-commons-resolver rocky 8 | 0:1.2-26.module+el8.10.0+2052+1b0fb438 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xmlstreambuffer RHEL 8 | 0:1.5.4-8.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | xmlstreambuffer almalinux 8 | 1.5.4-8.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xmlstreambuffer ol 8 | 0:1.5.4-8.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xmlstreambuffer rocky 8 | 0:1.5.4-8.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xsom RHEL 8 | 0:0-19.20110809svn.module+el8.10.0+20993+d0f024b0 | [RHSA-2026:90909](https://patchblox.com/security/data/fix/linux/rhsa-2026-90909.md) | Oct 29, 2026 |
| Linux | xsom almalinux 8 | 0-19.20110809svn.module_el8.5.0+2577+9e95fe00 | [ALSA-2026:90909](https://patchblox.com/security/data/fix/linux/alsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xsom ol 8 | 0:0-19.20110809svn.module+el8.10.0+91095+797d7a50 | [ELSA-2026-90909](https://patchblox.com/security/data/fix/linux/elsa-2026-90909.md) | Nov 7, 2026 |
| Linux | xsom rocky 8 | 0:0-19.20110809svn.module+el8.10.0+1763+c7c02164 | [RLSA-2026:90909](https://patchblox.com/security/data/fix/linux/rlsa-2026-90909.md) | Nov 7, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.