Skip to content
Fencer Vulns
high 8.1

CVE-2026-54513 json

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

published 2026-06-23 4 mo ago modified 2026-10-25 14 d ago also GHSA-rmj7-2vxq-3g9f , EUVD-2026-38593

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Patch / fix

  • maven com.fasterxml.jackson.core:jackson-databind 2.18.8, 2.21.4, 3.1.4
  • maven tools.jackson.core:jackson-databind 3.1.4
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-13
  • Red Hat Red Hat build of Keycloak 26.4 26.4-22, 26.4.14-1
  • Red Hat Red Hat build of Keycloak 26.4.14 openshift-rhel9, rhel9-operator
  • Red Hat Red Hat build of Keycloak 26.6 26.6-11, 26.6.5-1
  • Red Hat Red Hat build of Keycloak 26.6.5 openshift-rhel9, rhel9-operator
  • Red Hat Red Hat Certificate System 10.8 for RHEL-8 8100020260728001635.f9354743
  • Red Hat Red Hat Enterprise Linux 10 0:11.9.0-4.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:11.6.0-2.el10_0
  • Red Hat Red Hat Enterprise Linux 8 8100020260714102233.489197e6
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260720064222.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260720064222.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260720025549.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020260720025549.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260714161755.63b34585
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260714161755.63b34585
  • Red Hat Red Hat Enterprise Linux 9 0:2.21.4-1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.21.4-1.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.21.4-1.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.21.4-1.el9_6
  • Red Hat Red Hat OpenShift Dev Spaces 3.30 1787759145, 1787759723
  • jackson-databind Debian 14 2.18.11-1

debian advisories DEBIAN-CVE-2026-54513

  • eap8-jaxb jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-txw2 jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-xsom jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-log4j jboss enterprise application platform 8.1 2.25.4-1.redhat_00003.1.el10eap
  • eap8-netty jboss enterprise application platform 8.1 4.1.136-1.Final_redhat_00001.1.el10eap
  • eap8-rngom jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-slf4j jboss enterprise application platform 8.1 2.0.18-1.redhat_00001.1.el10eap
  • eap8-neethi jboss enterprise application platform 8.1 3.2.2-1.redhat_00001.1.el10eap

red hat advisories RHSA-2026:70230RHSA-2026:70229RHSA-2026:70228RHSA-2026:48095RHSA-2026:44271RHSA-2026:44065

  • jackson-core SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.22.3
  • jackson-databind SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.28.2
  • jackson-annotations SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.22.3
  • jackson-dataformats-binary SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.21.3
  • jackson-databind SLES for SAP applications 16.0, SLES 16.0 2.18.8-160000.1.1
  • jackson-core SLES for SAP applications 16.0, SLES 16.0 2.18.8-160000.1.1
  • jackson-annotations SLES for SAP applications 16.0, SLES 16.0 2.18.8-160000.1.1

suse advisories SUSE-SU-2026:2801-1SUSE-SU-2026:22504-1

  • jackson-databind openSUSE Leap 16.0 2.18.8-160000.1.1
  • jackson-core openSUSE Leap 16.0 2.18.8-160000.1.1
  • jackson-annotations openSUSE Leap 16.0 2.18.8-160000.1.1
  • jackson-databind openSUSE Tumbleweed 2.18.8-1.1

opensuse advisories openSUSE-SU-2026:21201-1openSUSE-SU-2026:11118-1

  • xsom AlmaLinux 8 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
  • slf4j AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • stax-ex AlmaLinux 8 1.7.7-8.module_el8.5.0+2577+9e95fe00
  • velocity AlmaLinux 8 1.7-24.module_el8.5.0+2577+9e95fe00
  • xalan-j2 AlmaLinux 8 2.7.1-38.module_el8.5.0+2577+9e95fe00
  • javassist AlmaLinux 8 3.18.1-8.module_el8.5.0+2577+9e95fe00
  • xerces-j2 AlmaLinux 8 2.11.0-34.module_el8.5.0+2577+9e95fe00
  • slf4j-jdk14 AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00

almalinux advisories ALSA-2026:43218ALSA-2026:43400ALSA-2026:40895

  • dogtag-pki Rocky Linux 10 11.9.0-4.el10_2.rocky.0.1
  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.10.0+1763+c7c02164
  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.10.0+2052+1b0fb438
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.6.0+843+5a13dac3
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+1763+c7c02164
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+2052+1b0fb438
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+2003+8aeac9cb
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d

rocky linux advisories RLSA-2026:43400RLSA-2026:43218RLSA-2026:40895

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54513 updated cvss 8.1

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

  • Red Hat build of Apache Camel - HawtIO 4 jackson-databind Red Hat build of Apache Camel 4 for Quarkus 3 jackson-databind
    affected: workaround, no fix available
  • Red Hat build of Debezium 3 jackson-databind
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Quarkus jackson-databind Red Hat JBoss Enterprise Application Platform 7 jackson-databind, eap74-els-openjdk8-openshift-rhel8, eap74-els-openjdk11-openshift-rhel8, eap74-els-openjdk17-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Dev Spaces devspaces/multicluster-redirector-rhel9
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 jackson-databind
    affected: workaround, no fix available “Fix deferred”
  • Red Hat AMQ Clients 2026.Q3
    fixed: vendor fix RHSA-2026:69459
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-13, cryostat/jfr-datasource-rhel9 4.2.0-13, cryostat/cryostat-reports-rhel9 4.2.0-13
    fixed: vendor fix RHSA-2026:48151
  • Red Hat AMQ Broker 7.13.6
    fixed: vendor fix RHSA-2026:66545
show 30 more
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat Build of Apache Camel 3.33.2.SP2 jackson-databind 2.21.4.redhat-00002
    fixed: vendor fix RHSA-2026:36839
  • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
    fixed: vendor fix RHSA-2026:54622
  • Red Hat build of Apicurio Registry 3.3.3
    fixed: vendor fix RHSA-2026:76637
  • Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9 26.4-22, rhbk/keycloak-rhel9-operator 26.4-22, rhbk/keycloak-operator-bundle 26.4.14-1
    fixed: vendor fix RHSA-2026:50847
  • Red Hat build of Keycloak 26.4.14
    fixed: vendor fix RHSA-2026:50846
  • Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-11, rhbk/keycloak-rhel9-operator 26.6-11, rhbk/keycloak-operator-bundle 26.6.5-1
    fixed: vendor fix RHSA-2026:50849
  • Red Hat build of Keycloak 26.6.5
    fixed: vendor fix RHSA-2026:50848
  • Red Hat build of Quarkus 3.27.4.SP2 jackson-databind 2.21.4.redhat-00002
    fixed: vendor fix RHSA-2026:36002
  • Red Hat build of Quarkus 3.33.2.SP2 jackson-databind 2.21.4.redhat-00002
    fixed: vendor fix RHSA-2026:36013
  • Red Hat Certificate System 10.8 for RHEL 8 jss 5.9.1-2.module+el8pki+24483+db4528cf, ldapjdk 5.6.0-3.module+el8pki+24228+5326976e, redhat-jss 5.9.1-2.module+el8pki+24483+db4528cf, redhat-pki 11.9.2-4.module+el8pki+24565+7517ad63, redhat-ldapjdk 5.6.0-3.module+el8pki+24228+5326976e, redhat-pki-ca 11.9.2-4.module+el8pki+24565+7517ad63, +19 more
    fixed: vendor fix RHSA-2026:48095
  • Red Hat Data Grid 8.6.2
    fixed: vendor fix RHSA-2026:41951
  • Red Hat Enterprise Linux AppStream (v. 8) slf4j 1.7.25-4.module+el8.10.0+20993+d0f024b0, stax-ex 1.7.7-8.module+el8.10.0+20993+d0f024b0, velocity 1.7-24.module+el8.10.0+20993+d0f024b0, bea-stax 1.2.0-16.module+el8.10.0+20993+d0f024b0, xalan-j2 2.7.1-38.module+el8.10.0+20993+d0f024b0, javassist 3.18.1-8.module+el8.10.0+20993+d0f024b0, +27 more
    fixed: vendor fix RHSA-2026:43218
  • Red Hat Enterprise Linux AppStream (v. 9) jackson-databind 2.21.4-1.el9_8, pki-jackson-databind 2.21.4-1.el9_8
    fixed: vendor fix RHSA-2026:40895
  • Red Hat Enterprise Linux AppStream (v. 10) dogtag-pki 11.9.0-4.el10_2, idm-pki-ca 11.9.0-4.el10_2, idm-pki-kra 11.9.0-4.el10_2, idm-pki-acme 11.9.0-4.el10_2, idm-pki-base 11.9.0-4.el10_2, idm-pki-java 11.9.0-4.el10_2, +3 more
    fixed: vendor fix RHSA-2026:43400
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix RHSA-2026:44062
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix RHSA-2026:44061
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +33 more
    fixed: vendor fix RHSA-2026:44066
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) jackson-databind 2.21.4-1.el9_2, pki-jackson-databind 2.21.4-1.el9_2
    fixed: vendor fix RHSA-2026:44063
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) jackson-databind 2.21.4-1.el9_4, pki-jackson-databind 2.21.4-1.el9_4
    fixed: vendor fix RHSA-2026:44065
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) dogtag-pki 11.6.0-2.el10_0, idm-pki-ca 11.6.0-2.el10_0, idm-pki-kra 11.6.0-2.el10_0, idm-pki-acme 11.6.0-2.el10_0, idm-pki-base 11.6.0-2.el10_0, idm-pki-java 11.6.0-2.el10_0, +3 more
    fixed: vendor fix RHSA-2026:44271
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) jackson-databind 2.21.4-1.el9_6, pki-jackson-databind 2.21.4-1.el9_6
    fixed: vendor fix RHSA-2026:44064
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix RHSA-2026:44062
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix RHSA-2026:44061
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +33 more
    fixed: vendor fix RHSA-2026:44066
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-jaxb 4.0.7-4.redhat_00001.1.el8eap, eap8-txw2 4.0.7-4.redhat_00001.1.el8eap, eap8-xsom 4.0.7-4.redhat_00001.1.el8eap, eap8-rngom 4.0.7-4.redhat_00001.1.el8eap, eap8-log4j 2.25.4-1.redhat_00003.1.el8eap, eap8-neethi 3.2.2-1.redhat_00001.1.el8eap, +101 more
    fixed: vendor fix RHSA-2026:70228
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-jaxb 4.0.7-4.redhat_00001.1.el9eap, eap8-txw2 4.0.7-4.redhat_00001.1.el9eap, eap8-xsom 4.0.7-4.redhat_00001.1.el9eap, eap8-rngom 4.0.7-4.redhat_00001.1.el9eap, eap8-log4j 2.25.4-1.redhat_00003.1.el9eap, eap8-neethi 3.2.2-1.redhat_00001.1.el9eap, +101 more
    fixed: vendor fix RHSA-2026:70229
  • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-jaxb 4.0.7-4.redhat_00001.1.el10eap, eap8-txw2 4.0.7-4.redhat_00001.1.el10eap, eap8-xsom 4.0.7-4.redhat_00001.1.el10eap, eap8-rngom 4.0.7-4.redhat_00001.1.el10eap, eap8-log4j 2.25.4-1.redhat_00003.1.el10eap, eap8-neethi 3.2.2-1.redhat_00001.1.el10eap, +100 more
    fixed: vendor fix RHSA-2026:70230
  • Red Hat JBoss Enterprise Application Platform 8.1.8.GA jackson-databind 2.18.9.redhat-00003
    fixed: vendor fix RHSA-2026:70277
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/openvsx-rhel9 1787759145, devspaces/pluginregistry-rhel9 1787759723
    fixed: vendor fix RHSA-2026:62260

1 more fixed, 22 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

1.23% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven com.fasterxml.jackson.core:jackson-databind
>=2.10.0, <2.18.8
>=2.19.0, <2.21.4
>=3.0.0, <3.1.4
2.18.8
2.21.4
3.1.4
maven tools.jackson.core:jackson-databind
>=3.0.0, <3.1.4
3.1.4

Affected products

  • FasterXML jackson-databind
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
  • Red Hat Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
  • Red Hat Red Hat build of Keycloak 26.4
  • Red Hat Red Hat build of Keycloak 26.4.14
  • Red Hat Red Hat build of Keycloak 26.6
  • Red Hat Red Hat build of Keycloak 26.6.5
  • Red Hat Red Hat Certificate System 10.8 for RHEL-8
  • Red Hat Red Hat Data Grid 8.6.2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Streams for Apache Kafka 3.2.1
  • Red Hat Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat AMQ Clients
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Lightspeed for Runtimes Operator
  • Red Hat Red Hat Offline Knowledge Portal
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2

Classification

Weakness
  • CWE-184 Incomplete List of Disallowed Inputs
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.