{"grype_matches":[{"artifact":{"id":"82ac89c7770c8252","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-10-17","epss":0.01576,"percentile":0.75052}],"risk":1.1820000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-10-17","epss":0.01576,"percentile":0.75052}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"82ac89c7770c8252","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-10-17","epss":0.01291,"percentile":0.69775}],"risk":1.00698,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-10-17","epss":0.01291,"percentile":0.69775}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"e2c3209465e4ad4d","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w9fj-cfpg-grvv","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w9fj-cfpg-grvv","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-10-17","epss":0.012,"percentile":0.67699}],"risk":0.972,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://nvd.nist.gov/vuln/detail/CVE-2026-33871"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w9fj-cfpg-grvv","description":"Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-33871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-10-17","epss":0.012,"percentile":0.67699}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33871","https://bugzilla.redhat.com/show_bug.cgi?id=2452456","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33871","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-17","epss":0.01226,"percentile":0.68355}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-17","epss":0.01226,"percentile":0.68355}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-17","epss":0.01226,"percentile":0.68355}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-17","epss":0.01226,"percentile":0.68355}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-17","epss":0.01226,"percentile":0.68355}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-17","epss":0.01226,"percentile":0.68355}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.10.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-17","epss":0.01226,"percentile":0.68355}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-17","epss":0.01226,"percentile":0.68355}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.80.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p93r-85wp-75v3","versionConstraint":">=1.71,<1.80.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p93r-85wp-75v3","fix":{"state":"fixed","versions":["1.80.2"],"available":[{"date":"2026-06-19","kind":"first-observed","version":"1.80.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:P/AU:Y/U:Red","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5598","date":"2026-10-17","epss":0.0096,"percentile":0.60871}],"risk":0.7872,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5598","https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5","https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87","https://github.com/bcgit/bc-java/wiki/CVE-2026-5598","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p93r-85wp-75v3","description":"Bouncy Castle Has Covert Timing Channel Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-5598","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Red","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5598","date":"2026-10-17","epss":0.0096,"percentile":0.60871}],"urls":["https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5","https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598","https://access.redhat.com/errata/RHSA-2026:12267","https://access.redhat.com/errata/RHSA-2026:12269","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/security/cve/CVE-2026-5598","https://bugzilla.redhat.com/show_bug.cgi?id=2458635","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5598","description":"Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).\n\n This vulnerability is associated with program files FrodoEngine.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-17","epss":0.01046,"percentile":0.63586}],"risk":0.7845000000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-17","epss":0.01046,"percentile":0.63586}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"e2c3209465e4ad4d","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-17","epss":0.01046,"percentile":0.63586}],"risk":0.7845000000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-17","epss":0.01046,"percentile":0.63586}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-17","epss":0.00999,"percentile":0.62157}],"risk":0.7792200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-17","epss":0.00999,"percentile":0.62157}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-17","epss":0.00999,"percentile":0.62157}],"risk":0.7792200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-17","epss":0.00999,"percentile":0.62157}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-17","epss":0.00999,"percentile":0.62157}],"risk":0.7792200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-17","epss":0.00999,"percentile":0.62157}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.10.0,<=2.18.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-17","epss":0.00999,"percentile":0.62157}],"risk":0.7792200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-17","epss":0.00999,"percentile":0.62157}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"f292a8aa0740a452","cpes":["cpe:2.3:a:apache:httpcore5-h2:5.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:httpcore5_h2:5.3.1:*:*:*:*:*:*:*"],"name":"httpcore5-h2","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.3.1","type":"java-archive","version":"5.3.1","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/httpcore5-h2-5.3.1.jar","manifestName":"","pomArtifactID":"httpcore5-h2","archiveDigests":[{"value":"760c34db3ba41b0ffa07e956bc308d3a12356915","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/httpcore5-h2-5.3.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/httpcore5-h2-5.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v3jc-474w-2wm6","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5-h2","version":"5.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v3jc-474w-2wm6","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-10-17","epss":0.0087,"percentile":0.58049}],"risk":0.6525,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54428","https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3","https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e","https://github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v3jc-474w-2wm6","description":"Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK"},"relatedVulnerabilities":[{"id":"CVE-2026-54428","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54428","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-54428","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54428","date":"2026-10-17","epss":0.0087,"percentile":0.58049}],"urls":["https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd","http://www.openwall.com/lists/oss-security/2026/07/01/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54428","description":"Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied."}]},{"artifact":{"id":"56b3db0e6c82cf19","cpes":["cpe:2.3:a:apache:httpcore5:5.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:core5:5.3.1:*:*:*:*:*:*:*"],"name":"httpcore5","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.3.1","type":"java-archive","version":"5.3.1","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/httpcore5-5.3.1.jar","manifestName":"","pomArtifactID":"httpcore5","archiveDigests":[{"value":"eaf64237945d7d0f301d48420e8bdb7f565a7b0e","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/httpcore5-5.3.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/httpcore5-5.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hf6x-8p5f-cgmf","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5","version":"5.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hf6x-8p5f-cgmf","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-10-17","epss":0.0087,"percentile":0.58048}],"risk":0.6525,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54399","https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4","https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e","https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hf6x-8p5f-cgmf","description":"Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-54399","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-10-17","epss":0.0087,"percentile":0.58048}],"urls":["https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54399","description":"Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length"}]},{"artifact":{"id":"a901cde3eb1e2d27","cpes":["cpe:2.3:a:apache:httpcore5:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:core5:5.3.4:*:*:*:*:*:*:*"],"name":"httpcore5","purl":"pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.3.4","type":"java-archive","version":"5.3.4","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents.core5","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/httpcore5-5.3.4.jar","manifestName":"","pomArtifactID":"httpcore5","archiveDigests":[{"value":"ea47f0fe6e00ffb07cec3a0cb1bb801b1a9cc353","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/httpcore5-5.3.4.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/httpcore5-5.3.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hf6x-8p5f-cgmf","versionConstraint":"<5.4.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.core5:httpcore5","version":"5.3.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hf6x-8p5f-cgmf","fix":{"state":"fixed","versions":["5.4.3"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"5.4.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-10-17","epss":0.0087,"percentile":0.58048}],"risk":0.6525,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-54399","https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4","https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e","https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hf6x-8p5f-cgmf","description":"Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-54399","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54399","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-54399","date":"2026-10-17","epss":0.0087,"percentile":0.58048}],"urls":["https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy","http://www.openwall.com/lists/oss-security/2026/07/01/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54399","description":"Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length"}]},{"artifact":{"id":"82ac89c7770c8252","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c653-97m9-rcg9","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c653-97m9-rcg9","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-10-17","epss":0.00721,"percentile":0.53046}],"risk":0.54075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://nvd.nist.gov/vuln/detail/CVE-2026-50010","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c653-97m9-rcg9","description":"Netty: Wrapping plain trust manager silently disables hostname verification"},"relatedVulnerabilities":[{"id":"CVE-2026-50010","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-10-17","epss":0.00721,"percentile":0.53046}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-50010","https://bugzilla.redhat.com/show_bug.cgi?id=2488429","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50010","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=\"HTTPS\" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-10-17","epss":0.00716,"percentile":0.52846}],"risk":0.52984,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-10-17","epss":0.00716,"percentile":0.52846}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.132.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":"<4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.1.132.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.1.132.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-10-17","epss":0.00698,"percentile":0.5214}],"risk":0.5235,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-10-17","epss":0.00698,"percentile":0.5214}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"bfa97feac2ad6149","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty-security:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty-security:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty_security:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty_security:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty-security:jetty:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty_security:jetty:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:9.4.58.v20250814:*:*:*:*:*:*:*"],"name":"jetty-security","purl":"pkg:maven/org.eclipse.jetty/jetty-security@9.4.58.v20250814","type":"java-archive","version":"9.4.58.v20250814","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/share/opensearch/plugins/opensearch-skills/spark-core_2.13-3.5.8.jar:org.eclipse.jetty:jetty-security","manifestName":"","pomArtifactID":"jetty-security","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-skills/spark-core_2.13-3.5.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-skills/spark-core_2.13-3.5.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.4.63"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fvj-hgj9-j2gr","versionConstraint":">=9.4.0.v20161208,<=9.4.58.v20250814 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-security","version":"9.4.58.v20250814"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2fvj-hgj9-j2gr","fix":{"state":"fixed","versions":["9.4.63"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"9.4.63"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-10-17","epss":0.00632,"percentile":0.49255}],"risk":0.51192,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://github.com/jetty/jetty.project/issues/15136","https://github.com/jetty/jetty.project/pull/15160","https://github.com/jetty/jetty.project/pull/15183","https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d","https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d","https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36","https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fvj-hgj9-j2gr","description":"Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution"},"relatedVulnerabilities":[{"id":"CVE-2026-10050","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-10-17","epss":0.00632,"percentile":0.49255}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10050","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e61145a455d661f7","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"42320dee29e4ce1c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c180d5a25918e7f4","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"8d4f62094c81050c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d1c97ba0b1128983","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-17","epss":0.0063,"percentile":0.49137}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"8d4f62094c81050c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"42320dee29e4ce1c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d1c97ba0b1128983","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e61145a455d661f7","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c180d5a25918e7f4","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-17","epss":0.00665,"percentile":0.50812}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"42320dee29e4ce1c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d1c97ba0b1128983","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"8d4f62094c81050c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e61145a455d661f7","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c180d5a25918e7f4","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e2c3209465e4ad4d","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"fdb51f27a8a78990","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http2-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"56375e341f0ca44079b1bfb62030285b9de5d713","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http2-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http2-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"0b0a9461b29ddad8","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http2-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"56375e341f0ca44079b1bfb62030285b9de5d713","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http2-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http2-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"34a34fa8182bccd7","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http2-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"56375e341f0ca44079b1bfb62030285b9de5d713","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http2-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http2-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.1.0.Final,<=4.1.135.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-17","epss":0.00665,"percentile":0.50811}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"4f863f949a8d977f","cpes":["cpe:2.3:a:apache:log4j-api:2.25.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_api:2.25.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.25.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:api:2.25.4:*:*:*:*:*:*:*"],"name":"log4j-api","purl":"pkg:maven/org.apache.logging.log4j/log4j-api@2.25.4","type":"java-archive","version":"2.25.4","language":"java","licenses":["\"Apache-2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0.txt\""],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/log4j-api-2.25.4.jar","manifestName":"","pomArtifactID":"log4j-api","archiveDigests":[{"value":"89ff2217b193fb187b134aa6ebcbfa8a28b018a9","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/log4j-api-2.25.4.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/log4j-api-2.25.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qv9r-c865-cp47","versionConstraint":">=2.13.1,<2.25.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-api","version":"2.25.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qv9r-c865-cp47","fix":{"state":"fixed","versions":["2.25.5"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"2.25.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49844","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49844","date":"2026-10-17","epss":0.00813,"percentile":0.5621}],"risk":0.459345,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-49844","https://github.com/apache/logging-log4j2/pull/4163","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message","https://logging.apache.org/security.html#CVE-2026-49844","https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300","https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82","https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5","https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qv9r-c865-cp47","description":"Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization"},"relatedVulnerabilities":[{"id":"CVE-2026-49844","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49844","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49844","date":"2026-10-17","epss":0.00813,"percentile":0.5621}],"urls":["https://github.com/apache/logging-log4j2/pull/4163","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message","https://logging.apache.org/security.html#CVE-2026-49844"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49844","description":"Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n  *  The application uses the  message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message  of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n  *  The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values."}]},{"artifact":{"id":"7fc75555111e990a","cpes":["cpe:2.3:a:apache:log4j-api:2.25.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_api:2.25.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.25.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:api:2.25.4:*:*:*:*:*:*:*"],"name":"log4j-api","purl":"pkg:maven/org.apache.logging.log4j/log4j-api@2.25.4","type":"java-archive","version":"2.25.4","language":"java","licenses":["\"Apache-2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0.txt\""],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/usr/share/opensearch/lib/log4j-api-2.25.4.jar","manifestName":"","pomArtifactID":"log4j-api","archiveDigests":[{"value":"89ff2217b193fb187b134aa6ebcbfa8a28b018a9","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/log4j-api-2.25.4.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/log4j-api-2.25.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qv9r-c865-cp47","versionConstraint":">=2.13.1,<2.25.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-api","version":"2.25.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qv9r-c865-cp47","fix":{"state":"fixed","versions":["2.25.5"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"2.25.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49844","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49844","date":"2026-10-17","epss":0.00813,"percentile":0.5621}],"risk":0.459345,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-49844","https://github.com/apache/logging-log4j2/pull/4163","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message","https://logging.apache.org/security.html#CVE-2026-49844","https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300","https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82","https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5","https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qv9r-c865-cp47","description":"Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization"},"relatedVulnerabilities":[{"id":"CVE-2026-49844","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49844","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49844","date":"2026-10-17","epss":0.00813,"percentile":0.5621}],"urls":["https://github.com/apache/logging-log4j2/pull/4163","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message","https://logging.apache.org/security.html#CVE-2026-49844"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49844","description":"Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n  *  The application uses the  message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message  of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n  *  The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values."}]},{"artifact":{"id":"e2c3209465e4ad4d","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c2gf-v879-257j","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c2gf-v879-257j","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-11","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-10-17","epss":0.00882,"percentile":0.58416}],"risk":0.45423,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://nvd.nist.gov/vuln/detail/CVE-2026-48043","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645","https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c2gf-v879-257j","description":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-48043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-10-17","epss":0.00882,"percentile":0.58416}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"61e6f8897d5a0493","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ad0e3c88248d64f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"3051772d593196d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f6deb16dd250346d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"b938fd22986ee151","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"b561e341f78d1ddb","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"812db68f551b0416","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f8feb5e85c2a169d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"363101a867c71a2c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ffe960256a789e68","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-17","epss":0.00581,"percentile":0.4662}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f98dc620649d5042","cpes":["cpe:2.3:a:jonathan-hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jonathan_hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:org.jsoup:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.15.3:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.15.3","type":"java-archive","version":"1.15.3","language":"java","licenses":["https://jsoup.org/license"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jsoup-1.15.3.jar","manifestName":"","pomArtifactID":"jsoup","archiveDigests":[{"value":"f6e1d8a8819f854b681c8eaa57fd59a42329e10c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jsoup-1.15.3.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jsoup-1.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-65r4-943x-97jj","versionConstraint":"<1.23.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-65r4-943x-97jj","fix":{"state":"fixed","versions":["1.23.2"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.23.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-10-17","epss":0.00525,"percentile":0.43274}],"risk":0.40950000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-75140","https://github.com/jhy/jsoup/pull/2556","https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-65r4-943x-97jj","description":"jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations"},"relatedVulnerabilities":[{"id":"CVE-2026-75140","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-10-17","epss":0.00525,"percentile":0.43274}],"urls":["https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://github.com/jhy/jsoup/pull/2556","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140","description":"jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application."}]},{"artifact":{"id":"c8a23b9e446d4c7a","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"459eb2c4bb30bd6898eb9bbe9d7a4c4140529b8b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.17.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-17","epss":0.00546,"percentile":0.44589}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-17","epss":0.00546,"percentile":0.44589}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"7f3dbd4e699b7ffc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"459eb2c4bb30bd6898eb9bbe9d7a4c4140529b8b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.17.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-17","epss":0.00546,"percentile":0.44589}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-17","epss":0.00546,"percentile":0.44589}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"d43d275c3b9818a3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/jackson-core-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"459eb2c4bb30bd6898eb9bbe9d7a4c4140529b8b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/jackson-core-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/jackson-core-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.17.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-17","epss":0.00546,"percentile":0.44589}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-17","epss":0.00546,"percentile":0.44589}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"0963e933c1daae90","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"14235096e357c4d7","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"c64182680ee3adc0","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.84","type":"java-archive","version":"1.84","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/bcprov-jdk15to18-1.84.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"eadf198ca82ee6e59cca8caab8ef293dfc0e5775","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/bcprov-jdk15to18-1.84.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/bcprov-jdk15to18-1.84.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.84"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"e28ed9f2dcf5f551","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.84:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84","type":"java-archive","version":"1.84","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/bcprov-jdk18on-1.84.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"2d5651789941d2f8ae9b8771f23356de6b61e96b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/bcprov-jdk18on-1.84.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/bcprov-jdk18on-1.84.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.84"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"a825ca9c071372ce","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.84:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84","type":"java-archive","version":"1.84","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/bcprov-jdk18on-1.84.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"2d5651789941d2f8ae9b8771f23356de6b61e96b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/bcprov-jdk18on-1.84.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/bcprov-jdk18on-1.84.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.84"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"6798128cd62bc483","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.84:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84","type":"java-archive","version":"1.84","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/bcprov-jdk18on-1.84.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"2d5651789941d2f8ae9b8771f23356de6b61e96b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/bcprov-jdk18on-1.84.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/bcprov-jdk18on-1.84.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.84"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-17","epss":0.0043,"percentile":0.358}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"58efe9c47e042bec","cpes":["cpe:2.3:a:bcpkix-jdk15to18:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix-jdk15to18:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk15to18:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk15to18:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcpkix-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcpkix-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcpkix-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcpkix-jdk15to18","archiveDigests":[{"value":"1998a94bba4d3568b39348b168a2312079b6eb2a","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcpkix-jdk15to18-1.79.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcpkix-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wg6q-6289-32hp","versionConstraint":">=1.49,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcpkix-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wg6q-6289-32hp","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-17","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-17","epss":0.00687,"percentile":0.5173}],"risk":0.388155,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5588","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wg6q-6289-32hp","description":"Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules"},"relatedVulnerabilities":[{"id":"CVE-2026-5588","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-17","epss":0.00687,"percentile":0.5173}],"urls":["https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-5588","https://bugzilla.redhat.com/show_bug.cgi?id=2458634","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5588.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5588","description":"Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).\n\n This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f6deb16dd250346d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"61e6f8897d5a0493","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ad0e3c88248d64f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"3051772d593196d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"812db68f551b0416","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f8feb5e85c2a169d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"363101a867c71a2c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ffe960256a789e68","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"b561e341f78d1ddb","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"b938fd22986ee151","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-17","epss":0.00717,"percentile":0.52898}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"5636c6a565675f0f","cpes":["cpe:2.3:a:netty-codec:netty-codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e8724fd648f68250","cpes":["cpe:2.3:a:io.netty.codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":[{"value":"cf36e54dc81aa160a93780478727bdb3c3fa4600","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"a242e1fdabd63366","cpes":["cpe:2.3:a:io.netty.codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":[{"value":"cf36e54dc81aa160a93780478727bdb3c3fa4600","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"69c023e5f4a548e1","cpes":["cpe:2.3:a:io.netty.codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":[{"value":"cf36e54dc81aa160a93780478727bdb3c3fa4600","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"71730667026eb1ea","cpes":["cpe:2.3:a:io.netty.codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":[{"value":"cf36e54dc81aa160a93780478727bdb3c3fa4600","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"04247c49b6b38f8e","cpes":["cpe:2.3:a:io.netty.codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":[{"value":"cf36e54dc81aa160a93780478727bdb3c3fa4600","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-codec-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-17","epss":0.0046,"percentile":0.38443}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"72911a8a2331d9b6","cpes":["cpe:2.3:a:org.jline.builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:builtins:3.27.1:*:*:*:*:*:*:*"],"name":"jline-builtins","purl":"pkg:maven/org.jline/jline-builtins@3.27.1","type":"java-archive","version":"3.27.1","language":"java","licenses":["https://opensource.org/licenses/BSD-3-Clause"],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","manifestName":"","pomArtifactID":"jline-builtins","archiveDigests":[{"value":"de8d19e5fdd7b932f3d8e23ecaa0c24a4897efa7","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r2xf-8xr9-62gw","versionConstraint":">=3.0.0,<3.30.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-builtins","version":"3.27.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r2xf-8xr9-62gw","fix":{"state":"fixed","versions":["3.30.15"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"3.30.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77422","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77422","date":"2026-10-17","epss":0.00496,"percentile":0.41211}],"risk":0.372,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r2xf-8xr9-62gw","description":"JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping"},"relatedVulnerabilities":[{"id":"CVE-2026-77422","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77422","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77422","date":"2026-10-17","epss":0.00496,"percentile":0.41211}],"urls":["https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77422","description":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xxqh-mfjm-7mv9","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xxqh-mfjm-7mv9","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42581","date":"2026-10-17","epss":0.00684,"percentile":0.51621}],"risk":0.36936,"urls":["https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9","https://nvd.nist.gov/vuln/detail/CVE-2026-42581"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xxqh-mfjm-7mv9","description":"Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization"},"relatedVulnerabilities":[{"id":"CVE-2026-42581","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42581","date":"2026-10-17","epss":0.00684,"percentile":0.51621}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42581","https://bugzilla.redhat.com/show_bug.cgi?id=2477232","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42581.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42581","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"7f3dbd4e699b7ffc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"459eb2c4bb30bd6898eb9bbe9d7a4c4140529b8b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-17","epss":0.00492,"percentile":0.4093}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-17","epss":0.00492,"percentile":0.4093}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"d43d275c3b9818a3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/jackson-core-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"459eb2c4bb30bd6898eb9bbe9d7a4c4140529b8b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/jackson-core-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/jackson-core-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-17","epss":0.00492,"percentile":0.4093}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-17","epss":0.00492,"percentile":0.4093}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"c8a23b9e446d4c7a","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"459eb2c4bb30bd6898eb9bbe9d7a4c4140529b8b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-17","epss":0.00492,"percentile":0.4093}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-17","epss":0.00492,"percentile":0.4093}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"5636c6a565675f0f","cpes":["cpe:2.3:a:netty-codec:netty-codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec","purl":"pkg:maven/io.netty/netty-codec@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec","manifestName":"","pomArtifactID":"netty-codec","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mj4r-2hfc-f8p6","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mj4r-2hfc-f8p6","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42583","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42583","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42583","date":"2026-10-17","epss":0.00486,"percentile":0.40493}],"risk":0.3645,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6","https://nvd.nist.gov/vuln/detail/CVE-2026-42583"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mj4r-2hfc-f8p6","description":"Netty Lz4FrameDecoder is vulnerable to resource exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-42583","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42583","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42583","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42583","date":"2026-10-17","epss":0.00486,"percentile":0.40493}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42583","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"42320dee29e4ce1c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"8d4f62094c81050c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e61145a455d661f7","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d1c97ba0b1128983","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c180d5a25918e7f4","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-17","epss":0.00609,"percentile":0.48097}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"14235096e357c4d7","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v6w3-qrh8-qccc","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v6w3-qrh8-qccc","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8798","cwe":"CWE-835","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8798","date":"2026-10-17","epss":0.00428,"percentile":0.35593}],"risk":0.34668,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8798","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908798"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v6w3-qrh8-qccc","description":"Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound"},"relatedVulnerabilities":[{"id":"CVE-2026-8798","cvss":[{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8798","cwe":"CWE-835","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8798","date":"2026-10-17","epss":0.00428,"percentile":0.35593}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8798","description":"In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long as that flag stayed clear, so a persistent failure of the on-chip entropy source - whether from a hardware fault, from the underlying DRBG being exhausted by contention across many cores, or from a hypervisor that does not provide the instruction - left the calling thread looping indefinitely inside the JNI call, where it could be neither interrupted nor timed out. Any operation drawing from the native entropy source could therefore hang, denying service to the application. The retry loops are now bounded (200 attempts for RDSEED and 20 for RDRAND, twice the baselines given in Intel's Digital Random Number Generator software implementation guide), pausing between attempts and, on exhaustion, clearing any partially written buffer and throwing rather than continuing to spin. The clear is performed by an un-elidable memzero, which uses a volatile pointer and an assembly memory barrier so that a compiler cannot optimise the erase away as a dead store. Bouncy Castle for Java (bcprov) is not affected, as it has no native entropy source; the 1.0.X and 2.0.X FIPS series are not affected."}]},{"artifact":{"id":"0963e933c1daae90","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v6w3-qrh8-qccc","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v6w3-qrh8-qccc","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8798","cwe":"CWE-835","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8798","date":"2026-10-17","epss":0.00428,"percentile":0.35593}],"risk":0.34668,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8798","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908798"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v6w3-qrh8-qccc","description":"Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound"},"relatedVulnerabilities":[{"id":"CVE-2026-8798","cvss":[{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8798","cwe":"CWE-835","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8798","date":"2026-10-17","epss":0.00428,"percentile":0.35593}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8798","description":"In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long as that flag stayed clear, so a persistent failure of the on-chip entropy source - whether from a hardware fault, from the underlying DRBG being exhausted by contention across many cores, or from a hypervisor that does not provide the instruction - left the calling thread looping indefinitely inside the JNI call, where it could be neither interrupted nor timed out. Any operation drawing from the native entropy source could therefore hang, denying service to the application. The retry loops are now bounded (200 attempts for RDSEED and 20 for RDRAND, twice the baselines given in Intel's Digital Random Number Generator software implementation guide), pausing between attempts and, on exhaustion, clearing any partially written buffer and throwing rather than continuing to spin. The clear is performed by an un-elidable memzero, which uses a volatile pointer and an assembly memory barrier so that a compiler cannot optimise the erase away as a dead store. Bouncy Castle for Java (bcprov) is not affected, as it has no native entropy source; the 1.0.X and 2.0.X FIPS series are not affected."}]},{"artifact":{"id":"14235096e357c4d7","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"0963e933c1daae90","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"c64182680ee3adc0","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.84:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.84","type":"java-archive","version":"1.84","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/bcprov-jdk15to18-1.84.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"eadf198ca82ee6e59cca8caab8ef293dfc0e5775","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/bcprov-jdk15to18-1.84.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/bcprov-jdk15to18-1.84.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.84"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"6798128cd62bc483","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.84:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84","type":"java-archive","version":"1.84","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/bcprov-jdk18on-1.84.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"2d5651789941d2f8ae9b8771f23356de6b61e96b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/bcprov-jdk18on-1.84.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/bcprov-jdk18on-1.84.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.84"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"e28ed9f2dcf5f551","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.84:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84","type":"java-archive","version":"1.84","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/bcprov-jdk18on-1.84.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"2d5651789941d2f8ae9b8771f23356de6b61e96b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/bcprov-jdk18on-1.84.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/bcprov-jdk18on-1.84.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.84"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"a825ca9c071372ce","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.84:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.84:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.84","type":"java-archive","version":"1.84","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/bcprov-jdk18on-1.84.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"2d5651789941d2f8ae9b8771f23356de6b61e96b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/bcprov-jdk18on-1.84.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/bcprov-jdk18on-1.84.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.84"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-17","epss":0.00442,"percentile":0.3695}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"f6deb16dd250346d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"812db68f551b0416","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"3051772d593196d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"f8feb5e85c2a169d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"363101a867c71a2c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"ffe960256a789e68","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"b561e341f78d1ddb","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"61e6f8897d5a0493","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"b938fd22986ee151","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"ad0e3c88248d64f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"363101a867c71a2c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"ad0e3c88248d64f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"f8feb5e85c2a169d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"3051772d593196d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"ffe960256a789e68","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"b561e341f78d1ddb","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"f6deb16dd250346d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"61e6f8897d5a0493","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"b938fd22986ee151","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"812db68f551b0416","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-17","epss":0.0045,"percentile":0.37701}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"e2c3209465e4ad4d","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-563q-j3cm-6jxm","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-563q-j3cm-6jxm","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50560","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50560","date":"2026-10-17","epss":0.00524,"percentile":0.43172}],"risk":0.29081999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm","https://nvd.nist.gov/vuln/detail/CVE-2026-50560","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-563q-j3cm-6jxm","description":"Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature"},"relatedVulnerabilities":[{"id":"CVE-2026-50560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50560","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50560","date":"2026-10-17","epss":0.00524,"percentile":0.43172}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm","https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50560","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-574f-3g2m-x479","versionConstraint":">=1.59,<=1.80.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-574f-3g2m-x479","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-14813","date":"2026-10-17","epss":0.0032,"percentile":0.23385}],"risk":0.27840000000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-14813","https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3","https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json","https://bugzilla.redhat.com/show_bug.cgi?id=2458640","https://access.redhat.com/security/cve/CVE-2025-14813","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-574f-3g2m-x479","description":"Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks"},"relatedVulnerabilities":[{"id":"CVE-2025-14813","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-14813","date":"2026-10-17","epss":0.0032,"percentile":0.23385}],"urls":["https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3","https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2025-14813","https://bugzilla.redhat.com/show_bug.cgi?id=2458640","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14813","description":": Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).\n\n This vulnerability is associated with program files G3413CTRBlockCipher.\n\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c3fc-8qff-9hwx","versionConstraint":">=1.74,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c3fc-8qff-9hwx","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-18","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-17","epss":0.00527,"percentile":0.43412}],"risk":0.276675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-0636","https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c3fc-8qff-9hwx","description":"Bouncy Castle has an LDAP injection"},"relatedVulnerabilities":[{"id":"CVE-2026-0636","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-17","epss":0.00527,"percentile":0.43412}],"urls":["https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-0636","https://bugzilla.redhat.com/show_bug.cgi?id=2458641","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0636","description":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\n\n This vulnerability is associated with program files LDAPStoreHelper.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"f6deb16dd250346d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"ad0e3c88248d64f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"b938fd22986ee151","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"61e6f8897d5a0493","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"b561e341f78d1ddb","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"ffe960256a789e68","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"363101a867c71a2c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"f8feb5e85c2a169d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"812db68f551b0416","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"3051772d593196d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-17","epss":0.00529,"percentile":0.43506}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"cbf268e55fa6a9b3","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.10.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.10.1","type":"java-archive","version":"1.10.1","language":"java","licenses":["Apache License, Version 2.0"],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"f541d7f910fe3d76f38f799c507c48cc81b12ecb","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xx22-p4ch-683r","versionConstraint":"<=1.11.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.10.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xx22-p4ch-683r","fix":{"state":"fixed","versions":["1.11.1"],"available":[{"date":"2026-07-24","kind":"first-observed","version":"1.11.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59949","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59949","date":"2026-10-17","epss":0.00466,"percentile":0.3894}],"risk":0.26795,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r","https://github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910da","https://github.com/yawkat/lz4-java/releases/tag/v1.11.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xx22-p4ch-683r","description":"LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges"},"relatedVulnerabilities":[{"id":"CVE-2026-59949","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59949","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59949","date":"2026-10-17","epss":0.00466,"percentile":0.3894}],"urls":["https://github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910da","https://github.com/yawkat/lz4-java/releases/tag/v1.11.1","https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59949","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1."}]},{"artifact":{"id":"e2c3209465e4ad4d","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5x3r-wrvg-rp6q","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5x3r-wrvg-rp6q","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47244","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-47244","date":"2026-10-17","epss":0.00507,"percentile":0.41927}],"risk":0.26110500000000003,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-47244"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5x3r-wrvg-rp6q","description":"Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced"},"relatedVulnerabilities":[{"id":"CVE-2026-47244","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47244","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-47244","date":"2026-10-17","epss":0.00507,"percentile":0.41927}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47244","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"82ac89c7770c8252","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4c3-7fpv-j4q5","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4c3-7fpv-j4q5","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"risk":0.250685,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","https://nvd.nist.gov/vuln/detail/CVE-2026-75595","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","description":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"},"relatedVulnerabilities":[{"id":"CVE-2026-75595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"3c53d4df50898280","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4c3-7fpv-j4q5","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4c3-7fpv-j4q5","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"risk":0.250685,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","https://nvd.nist.gov/vuln/detail/CVE-2026-75595","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","description":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"},"relatedVulnerabilities":[{"id":"CVE-2026-75595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"2c7a146e586e2eee","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4c3-7fpv-j4q5","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4c3-7fpv-j4q5","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"risk":0.250685,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","https://nvd.nist.gov/vuln/detail/CVE-2026-75595","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","description":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"},"relatedVulnerabilities":[{"id":"CVE-2026-75595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"759c23a5c904b61a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4c3-7fpv-j4q5","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4c3-7fpv-j4q5","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"risk":0.250685,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","https://nvd.nist.gov/vuln/detail/CVE-2026-75595","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","description":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"},"relatedVulnerabilities":[{"id":"CVE-2026-75595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"a419759d3ee2ea4c","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4c3-7fpv-j4q5","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4c3-7fpv-j4q5","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"risk":0.250685,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","https://nvd.nist.gov/vuln/detail/CVE-2026-75595","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","description":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"},"relatedVulnerabilities":[{"id":"CVE-2026-75595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"40e55a274f561166","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4c3-7fpv-j4q5","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4c3-7fpv-j4q5","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"risk":0.250685,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","https://nvd.nist.gov/vuln/detail/CVE-2026-75595","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","description":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"},"relatedVulnerabilities":[{"id":"CVE-2026-75595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-17","epss":0.00277,"percentile":0.18869}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"72911a8a2331d9b6","cpes":["cpe:2.3:a:org.jline.builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:builtins:3.27.1:*:*:*:*:*:*:*"],"name":"jline-builtins","purl":"pkg:maven/org.jline/jline-builtins@3.27.1","type":"java-archive","version":"3.27.1","language":"java","licenses":["https://opensource.org/licenses/BSD-3-Clause"],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","manifestName":"","pomArtifactID":"jline-builtins","archiveDigests":[{"value":"de8d19e5fdd7b932f3d8e23ecaa0c24a4897efa7","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ph9c-7hw9-vhhw","versionConstraint":">=3.0.0,<3.30.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-builtins","version":"3.27.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ph9c-7hw9-vhhw","fix":{"state":"fixed","versions":["3.30.15"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"3.30.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77421","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77421","date":"2026-10-17","epss":0.00434,"percentile":0.36203}],"risk":0.24955,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ph9c-7hw9-vhhw","description":"JLine: ReDoS in Nano Editor Regex Search Mode"},"relatedVulnerabilities":[{"id":"CVE-2026-77421","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77421","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77421","date":"2026-10-17","epss":0.00434,"percentile":0.36203}],"urls":["https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77421","description":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gcjf-9mgh-3p7g","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gcjf-9mgh-3p7g","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"risk":0.248775,"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","description":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"},"relatedVulnerabilities":[{"id":"CVE-2026-59921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d1c97ba0b1128983","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gcjf-9mgh-3p7g","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gcjf-9mgh-3p7g","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"risk":0.248775,"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","description":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"},"relatedVulnerabilities":[{"id":"CVE-2026-59921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"8d4f62094c81050c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gcjf-9mgh-3p7g","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gcjf-9mgh-3p7g","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"risk":0.248775,"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","description":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"},"relatedVulnerabilities":[{"id":"CVE-2026-59921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"42320dee29e4ce1c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gcjf-9mgh-3p7g","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gcjf-9mgh-3p7g","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"risk":0.248775,"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","description":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"},"relatedVulnerabilities":[{"id":"CVE-2026-59921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e61145a455d661f7","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gcjf-9mgh-3p7g","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gcjf-9mgh-3p7g","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"risk":0.248775,"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","description":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"},"relatedVulnerabilities":[{"id":"CVE-2026-59921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c180d5a25918e7f4","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gcjf-9mgh-3p7g","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gcjf-9mgh-3p7g","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"risk":0.248775,"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","description":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"},"relatedVulnerabilities":[{"id":"CVE-2026-59921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-17","epss":0.00465,"percentile":0.38873}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mp9-239f-g9hg","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4mp9-239f-g9hg","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"risk":0.24803499999999998,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","description":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation"},"relatedVulnerabilities":[{"id":"CVE-2026-59898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","description":"Netty is an asynchronous, event-driven network application framework.  Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"8d4f62094c81050c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mp9-239f-g9hg","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4mp9-239f-g9hg","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"risk":0.24803499999999998,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","description":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation"},"relatedVulnerabilities":[{"id":"CVE-2026-59898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","description":"Netty is an asynchronous, event-driven network application framework.  Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c180d5a25918e7f4","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mp9-239f-g9hg","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4mp9-239f-g9hg","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"risk":0.24803499999999998,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","description":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation"},"relatedVulnerabilities":[{"id":"CVE-2026-59898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","description":"Netty is an asynchronous, event-driven network application framework.  Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e61145a455d661f7","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mp9-239f-g9hg","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4mp9-239f-g9hg","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"risk":0.24803499999999998,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","description":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation"},"relatedVulnerabilities":[{"id":"CVE-2026-59898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","description":"Netty is an asynchronous, event-driven network application framework.  Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"42320dee29e4ce1c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mp9-239f-g9hg","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4mp9-239f-g9hg","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"risk":0.24803499999999998,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","description":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation"},"relatedVulnerabilities":[{"id":"CVE-2026-59898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","description":"Netty is an asynchronous, event-driven network application framework.  Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d1c97ba0b1128983","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mp9-239f-g9hg","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4mp9-239f-g9hg","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"risk":0.24803499999999998,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","description":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation"},"relatedVulnerabilities":[{"id":"CVE-2026-59898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-17","epss":0.00439,"percentile":0.36715}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","description":"Netty is an asynchronous, event-driven network application framework.  Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pjw-73gf-8qr5","versionConstraint":">=2.15.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pjw-73gf-8qr5","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59888","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59888","date":"2026-10-17","epss":0.00423,"percentile":0.35174}],"risk":0.243225,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5","https://nvd.nist.gov/vuln/detail/CVE-2026-59888","https://github.com/FasterXML/jackson-databind/pull/5974","https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pjw-73gf-8qr5","description":"jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy"},"relatedVulnerabilities":[{"id":"CVE-2026-59888","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59888","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59888","date":"2026-10-17","epss":0.00423,"percentile":0.35174}],"urls":["https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d","https://github.com/FasterXML/jackson-databind/pull/5974","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59888","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pjw-73gf-8qr5","versionConstraint":">=2.15.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pjw-73gf-8qr5","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59888","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59888","date":"2026-10-17","epss":0.00423,"percentile":0.35174}],"risk":0.243225,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5","https://nvd.nist.gov/vuln/detail/CVE-2026-59888","https://github.com/FasterXML/jackson-databind/pull/5974","https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pjw-73gf-8qr5","description":"jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy"},"relatedVulnerabilities":[{"id":"CVE-2026-59888","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59888","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59888","date":"2026-10-17","epss":0.00423,"percentile":0.35174}],"urls":["https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d","https://github.com/FasterXML/jackson-databind/pull/5974","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59888","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-41254","versionConstraint":"< 1.8.0_502||>= 1.9, < 8.0.502||>= 12, < 17.0.20||>= 18, < 21.0.12||>= 22, < 25.0.4||>= 26, < 26.0.2||>= 9, < 11.0.32 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-41254","fix":{"state":"fixed","versions":["1.8.0_502","8.0.502","11.0.32","17.0.20","21.0.12","25.0.4","26.0.2"],"available":[{"date":"2026-08-15","kind":"first-observed","version":"1.8.0_502"},{"date":"2026-08-15","kind":"first-observed","version":"8.0.502"},{"date":"2026-08-15","kind":"first-observed","version":"17.0.20"},{"date":"2026-08-15","kind":"first-observed","version":"21.0.12"},{"date":"2026-08-15","kind":"first-observed","version":"25.0.4"},{"date":"2026-08-15","kind":"first-observed","version":"26.0.2"},{"date":"2026-08-15","kind":"first-observed","version":"11.0.32"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4,"impactScore":2.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41254","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-41254","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-41254","date":"2026-10-17","epss":0.00364,"percentile":0.28705}],"risk":0.24115,"urls":["https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/","https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0","https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc","https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq","https://www.openwall.com/lists/oss-security/2026/04/17/16","https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html","https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc#commitcomment-183284136","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41254","description":"Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication."},"relatedVulnerabilities":[]},{"artifact":{"id":"5b006a2851dc256c","cpes":["cpe:2.3:a:apache:httpclient5:5.4.3:*:*:*:*:*:*:*","cpe:2.3:a:apache:client5:5.4.3:*:*:*:*:*:*:*"],"name":"httpclient5","purl":"pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.3","type":"java-archive","version":"5.4.3","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents.client5","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/httpclient5-5.4.3.jar","manifestName":"","pomArtifactID":"httpclient5","archiveDigests":[{"value":"2f3fc0687c6fa39b0aad7cf7c3cf171ec8ad009b","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/httpclient5-5.4.3.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/httpclient5-5.4.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.6.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hjcp-jmpx-g3qm","versionConstraint":">=5.0-alpha1,<5.6.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents.client5:httpclient5","version":"5.4.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hjcp-jmpx-g3qm","fix":{"state":"fixed","versions":["5.6.3"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"5.6.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64607","cwe":"CWE-772","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-64607","date":"2026-10-17","epss":0.00464,"percentile":0.38796}],"risk":0.23896,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-64607","https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q","https://github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94","https://github.com/apache/httpcomponents-client/commit/ebac9512f555c4a355cad3f59ef2db69b597cc97","https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.6.3","https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.7-alpha1","http://www.openwall.com/lists/oss-security/2026/08/13/5"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hjcp-jmpx-g3qm","description":"Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-64607","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64607","cwe":"CWE-772","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-64607","date":"2026-10-17","epss":0.00464,"percentile":0.38796}],"urls":["https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q","http://www.openwall.com/lists/oss-security/2026/08/13/5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64607","description":"HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2."}]},{"artifact":{"id":"e2c3209465e4ad4d","cpes":["cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http2","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c69g-56f8-xwqj","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c69g-56f8-xwqj","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-17","epss":0.00398,"percentile":0.3249}],"risk":0.23680999999999996,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c69g-56f8-xwqj","description":"Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-59900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-17","epss":0.00398,"percentile":0.3249}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59900","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"0b0a9461b29ddad8","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http2-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"56375e341f0ca44079b1bfb62030285b9de5d713","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http2-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http2-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c69g-56f8-xwqj","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c69g-56f8-xwqj","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-17","epss":0.00398,"percentile":0.3249}],"risk":0.23680999999999996,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c69g-56f8-xwqj","description":"Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-59900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-17","epss":0.00398,"percentile":0.3249}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59900","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"34a34fa8182bccd7","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http2-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"56375e341f0ca44079b1bfb62030285b9de5d713","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http2-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http2-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c69g-56f8-xwqj","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c69g-56f8-xwqj","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-17","epss":0.00398,"percentile":0.3249}],"risk":0.23680999999999996,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c69g-56f8-xwqj","description":"Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-59900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-17","epss":0.00398,"percentile":0.3249}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59900","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"fdb51f27a8a78990","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http2-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"56375e341f0ca44079b1bfb62030285b9de5d713","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http2-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http2-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c69g-56f8-xwqj","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c69g-56f8-xwqj","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-17","epss":0.00398,"percentile":0.3249}],"risk":0.23680999999999996,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c69g-56f8-xwqj","description":"Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-59900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-17","epss":0.00398,"percentile":0.3249}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59900","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cqp-g7gg-8hr5","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cqp-g7gg-8hr5","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"risk":0.2346,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","https://nvd.nist.gov/vuln/detail/CVE-2026-56746","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","description":"Netty: Security Control Bypass via CORS Short-Circuit Failure"},"relatedVulnerabilities":[{"id":"CVE-2026-56746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","description":"Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d1c97ba0b1128983","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cqp-g7gg-8hr5","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cqp-g7gg-8hr5","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"risk":0.2346,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","https://nvd.nist.gov/vuln/detail/CVE-2026-56746","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","description":"Netty: Security Control Bypass via CORS Short-Circuit Failure"},"relatedVulnerabilities":[{"id":"CVE-2026-56746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","description":"Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c180d5a25918e7f4","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cqp-g7gg-8hr5","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cqp-g7gg-8hr5","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"risk":0.2346,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","https://nvd.nist.gov/vuln/detail/CVE-2026-56746","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","description":"Netty: Security Control Bypass via CORS Short-Circuit Failure"},"relatedVulnerabilities":[{"id":"CVE-2026-56746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","description":"Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"e61145a455d661f7","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cqp-g7gg-8hr5","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cqp-g7gg-8hr5","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"risk":0.2346,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","https://nvd.nist.gov/vuln/detail/CVE-2026-56746","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","description":"Netty: Security Control Bypass via CORS Short-Circuit Failure"},"relatedVulnerabilities":[{"id":"CVE-2026-56746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","description":"Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"8d4f62094c81050c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cqp-g7gg-8hr5","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cqp-g7gg-8hr5","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"risk":0.2346,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","https://nvd.nist.gov/vuln/detail/CVE-2026-56746","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","description":"Netty: Security Control Bypass via CORS Short-Circuit Failure"},"relatedVulnerabilities":[{"id":"CVE-2026-56746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","description":"Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"42320dee29e4ce1c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.136.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cqp-g7gg-8hr5","versionConstraint":"<4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cqp-g7gg-8hr5","fix":{"state":"fixed","versions":["4.1.136.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.1.136.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"risk":0.2346,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","https://nvd.nist.gov/vuln/detail/CVE-2026-56746","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","description":"Netty: Security Control Bypass via CORS Short-Circuit Failure"},"relatedVulnerabilities":[{"id":"CVE-2026-56746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-17","epss":0.00408,"percentile":0.33562}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","description":"Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"f6deb16dd250346d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"61e6f8897d5a0493","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"3051772d593196d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"b561e341f78d1ddb","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"ffe960256a789e68","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"f8feb5e85c2a169d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"363101a867c71a2c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"b938fd22986ee151","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"ad0e3c88248d64f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"812db68f551b0416","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.8.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-17","epss":0.00443,"percentile":0.37043}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"812db68f551b0416","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"ffe960256a789e68","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"ad0e3c88248d64f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"b938fd22986ee151","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"61e6f8897d5a0493","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"3051772d593196d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"f8feb5e85c2a169d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"363101a867c71a2c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"b561e341f78d1ddb","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"f6deb16dd250346d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"risk":0.22367499999999996,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-17","epss":0.00389,"percentile":0.31396}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"82ac89c7770c8252","cpes":["cpe:2.3:a:netty-handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-handler","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fccg-mwvh-qqg4","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fccg-mwvh-qqg4","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"risk":0.22253,"urls":["https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","https://nvd.nist.gov/vuln/detail/CVE-2026-75596","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","description":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-75596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"759c23a5c904b61a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fccg-mwvh-qqg4","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fccg-mwvh-qqg4","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"risk":0.22253,"urls":["https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","https://nvd.nist.gov/vuln/detail/CVE-2026-75596","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","description":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-75596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"2c7a146e586e2eee","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fccg-mwvh-qqg4","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fccg-mwvh-qqg4","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"risk":0.22253,"urls":["https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","https://nvd.nist.gov/vuln/detail/CVE-2026-75596","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","description":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-75596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"40e55a274f561166","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fccg-mwvh-qqg4","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fccg-mwvh-qqg4","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"risk":0.22253,"urls":["https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","https://nvd.nist.gov/vuln/detail/CVE-2026-75596","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","description":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-75596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"a419759d3ee2ea4c","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fccg-mwvh-qqg4","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fccg-mwvh-qqg4","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"risk":0.22253,"urls":["https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","https://nvd.nist.gov/vuln/detail/CVE-2026-75596","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","description":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-75596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"3c53d4df50898280","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-handler-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"567f8742a3d7a0a8be0401dada8fbdbaa7bf02b6","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-handler-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-handler-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fccg-mwvh-qqg4","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fccg-mwvh-qqg4","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"risk":0.22253,"urls":["https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","https://nvd.nist.gov/vuln/detail/CVE-2026-75596","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","description":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-75596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-17","epss":0.00374,"percentile":0.2979}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m4cv-j2px-7723","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m4cv-j2px-7723","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42580","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42580","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42580","date":"2026-10-17","epss":0.00362,"percentile":0.28512}],"risk":0.20815,"urls":["https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723","https://nvd.nist.gov/vuln/detail/CVE-2026-42580"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m4cv-j2px-7723","description":"Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-42580","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42580","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42580","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42580","date":"2026-10-17","epss":0.00362,"percentile":0.28512}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42580","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.135.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hvcg-qmg6-jm4c","versionConstraint":"<=4.1.134.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hvcg-qmg6-jm4c","fix":{"state":"fixed","versions":["4.1.135.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.1.135.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50020","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50020","date":"2026-10-17","epss":0.00398,"percentile":0.32492}],"risk":0.20497,"urls":["https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c","https://nvd.nist.gov/vuln/detail/CVE-2026-50020","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hvcg-qmg6-jm4c","description":"Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted"},"relatedVulnerabilities":[{"id":"CVE-2026-50020","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50020","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50020","date":"2026-10-17","epss":0.00398,"percentile":0.32492}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50020","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"14235096e357c4d7","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-98j2-6v39-78w8","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-98j2-6v39-78w8","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13505","cwe":"CWE-772","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13505","date":"2026-10-17","epss":0.00253,"percentile":0.15692}],"risk":0.20493,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13505","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-98j2-6v39-78w8","description":"Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization."},"relatedVulnerabilities":[{"id":"CVE-2026-13505","cvss":[{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13505","cwe":"CWE-772","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13505","date":"2026-10-17","epss":0.00253,"percentile":0.15692}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13505","description":"In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by overriding Object.finalize. Finalization runs at an unspecified time and in an unspecified order and is serviced by a single finalizer thread, so where objects carrying a finalizer are allocated faster than that thread retires them the pending-finalization queue grows without bound: disposal falls arbitrarily far behind, which can contribute to an OutOfMemoryError under load, and the key material those objects hold stays resident in the heap for as long as they are queued, defeating the purpose of the zeroisation. The behaviour was not a problem on Java 8 or Java 11; it is later JVMs, on which finalization has been deprecated and progressively de-emphasised, where it becomes one. Disposal of these classes now runs from a java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay, so on Java 9 and later it no longer depends on the finalizer being scheduled. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected, as neither implements the finalizer-based zeroisation scheme."}]},{"artifact":{"id":"0963e933c1daae90","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/plugin-cli/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-98j2-6v39-78w8","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-98j2-6v39-78w8","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13505","cwe":"CWE-772","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13505","date":"2026-10-17","epss":0.00253,"percentile":0.15692}],"risk":0.20493,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13505","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-98j2-6v39-78w8","description":"Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization."},"relatedVulnerabilities":[{"id":"CVE-2026-13505","cvss":[{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13505","cwe":"CWE-772","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13505","date":"2026-10-17","epss":0.00253,"percentile":0.15692}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13505","description":"In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by overriding Object.finalize. Finalization runs at an unspecified time and in an unspecified order and is serviced by a single finalizer thread, so where objects carrying a finalizer are allocated faster than that thread retires them the pending-finalization queue grows without bound: disposal falls arbitrarily far behind, which can contribute to an OutOfMemoryError under load, and the key material those objects hold stays resident in the heap for as long as they are queued, defeating the purpose of the zeroisation. The behaviour was not a problem on Java 8 or Java 11; it is later JVMs, on which finalization has been deprecated and progressively de-emphasised, where it becomes one. Disposal of these classes now runs from a java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay, so on Java 9 and later it no longer depends on the finalizer being scheduled. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected, as neither implements the finalizer-based zeroisation scheme."}]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-47063","versionConstraint":"< 1.8.0_502||>= 1.9, < 8.0.502||>= 12, < 17.0.20||>= 18, < 21.0.12||>= 22, < 25.0.4||>= 26, < 26.0.2||>= 9, < 11.0.32 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-47063","fix":{"state":"fixed","versions":["1.8.0_502","8.0.502","11.0.32","17.0.20","21.0.12","25.0.4","26.0.2"],"available":[{"date":"2026-08-15","kind":"first-observed","version":"1.8.0_502"},{"date":"2026-08-15","kind":"first-observed","version":"8.0.502"},{"date":"2026-08-15","kind":"first-observed","version":"17.0.20"},{"date":"2026-08-15","kind":"first-observed","version":"21.0.12"},{"date":"2026-08-15","kind":"first-observed","version":"25.0.4"},{"date":"2026-08-15","kind":"first-observed","version":"26.0.2"},{"date":"2026-08-15","kind":"first-observed","version":"11.0.32"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47063","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47063","date":"2026-10-17","epss":0.00256,"percentile":0.16082}],"risk":0.19200000000000003,"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47063","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"cbf268e55fa6a9b3","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.10.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.10.1","type":"java-archive","version":"1.10.1","language":"java","licenses":["Apache License, Version 2.0"],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"f541d7f910fe3d76f38f799c507c48cc81b12ecb","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cx8-rjf8-pr8g","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.10.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cx8-rjf8-pr8g","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-10-17","epss":0.00371,"percentile":0.29512}],"risk":0.191065,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g","https://nvd.nist.gov/vuln/detail/CVE-2026-106453","https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cx8-rjf8-pr8g","description":"yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError"},"relatedVulnerabilities":[{"id":"CVE-2026-106453","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-10-17","epss":0.00371,"percentile":0.29512}],"urls":["https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106453","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"cbf268e55fa6a9b3","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.10.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.10.1","type":"java-archive","version":"1.10.1","language":"java","licenses":["Apache License, Version 2.0"],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"f541d7f910fe3d76f38f799c507c48cc81b12ecb","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gm45-99xc-r7wv","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.10.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gm45-99xc-r7wv","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-10-17","epss":0.00371,"percentile":0.29512}],"risk":0.191065,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv","https://nvd.nist.gov/vuln/detail/CVE-2026-106450","https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gm45-99xc-r7wv","description":"yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs"},"relatedVulnerabilities":[{"id":"CVE-2026-106450","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-10-17","epss":0.00371,"percentile":0.29512}],"urls":["https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106450","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"cbf268e55fa6a9b3","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.10.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.10.1","type":"java-archive","version":"1.10.1","language":"java","licenses":["Apache License, Version 2.0"],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"f541d7f910fe3d76f38f799c507c48cc81b12ecb","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4v53-57pg-c464","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.10.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4v53-57pg-c464","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-10-17","epss":0.00371,"percentile":0.29511}],"risk":0.191065,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464","https://nvd.nist.gov/vuln/detail/CVE-2026-106452","https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4v53-57pg-c464","description":"yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header"},"relatedVulnerabilities":[{"id":"CVE-2026-106452","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-10-17","epss":0.00371,"percentile":0.29511}],"urls":["https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106452","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgj6-7826-r7m5","versionConstraint":">=2.0.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hgj6-7826-r7m5","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-17","epss":0.00368,"percentile":0.29108}],"risk":0.18952000000000002,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://nvd.nist.gov/vuln/detail/CVE-2026-54514"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgj6-7826-r7m5","description":"jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)"},"relatedVulnerabilities":[{"id":"CVE-2026-54514","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-17","epss":0.00368,"percentile":0.29108}],"urls":["https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgj6-7826-r7m5","versionConstraint":">=2.0.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hgj6-7826-r7m5","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-17","epss":0.00368,"percentile":0.29108}],"risk":0.18952000000000002,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://nvd.nist.gov/vuln/detail/CVE-2026-54514"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgj6-7826-r7m5","description":"jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)"},"relatedVulnerabilities":[{"id":"CVE-2026-54514","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-17","epss":0.00368,"percentile":0.29108}],"urls":["https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgj6-7826-r7m5","versionConstraint":">=2.0.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hgj6-7826-r7m5","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-17","epss":0.00368,"percentile":0.29108}],"risk":0.18952000000000002,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://nvd.nist.gov/vuln/detail/CVE-2026-54514"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgj6-7826-r7m5","description":"jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)"},"relatedVulnerabilities":[{"id":"CVE-2026-54514","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-17","epss":0.00368,"percentile":0.29108}],"urls":["https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgj6-7826-r7m5","versionConstraint":">=2.0.0,<2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hgj6-7826-r7m5","fix":{"state":"fixed","versions":["2.18.8"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.18.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-17","epss":0.00368,"percentile":0.29108}],"risk":0.18952000000000002,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://nvd.nist.gov/vuln/detail/CVE-2026-54514"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgj6-7826-r7m5","description":"jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)"},"relatedVulnerabilities":[{"id":"CVE-2026-54514","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-17","epss":0.00368,"percentile":0.29108}],"urls":["https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12.1"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-61308","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-61308","fix":{"state":"fixed","versions":["1.8.0_504","8.0.504","11.0.32.1","17.0.20.1","21.0.12.1","25.0.4.1","26.0.2.1"],"available":[{"date":"2026-08-25","kind":"first-observed","version":"1.8.0_504"},{"date":"2026-08-25","kind":"first-observed","version":"8.0.504"},{"date":"2026-08-25","kind":"first-observed","version":"17.0.20.1"},{"date":"2026-08-25","kind":"first-observed","version":"21.0.12.1"},{"date":"2026-08-25","kind":"first-observed","version":"25.0.4.1"},{"date":"2026-08-25","kind":"first-observed","version":"26.0.2.1"},{"date":"2026-08-25","kind":"first-observed","version":"11.0.32.1"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61308","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61308","date":"2026-10-17","epss":0.0031,"percentile":0.22292}],"risk":0.18289999999999998,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61308","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v8h7-rr48-vmmv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v8h7-rr48-vmmv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-06","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41417","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41417","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41417","date":"2026-10-17","epss":0.00336,"percentile":0.25413}],"risk":0.17304000000000003,"urls":["https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv","https://nvd.nist.gov/vuln/detail/CVE-2026-41417"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v8h7-rr48-vmmv","description":"Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection"},"relatedVulnerabilities":[{"id":"CVE-2026-41417","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41417","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41417","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41417","date":"2026-10-17","epss":0.00336,"percentile":0.25413}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41417","description":"Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.133.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-38f8-5428-x5cv","versionConstraint":"<=4.1.132.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-38f8-5428-x5cv","fix":{"state":"fixed","versions":["4.1.133.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.1.133.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42585","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42585","date":"2026-10-17","epss":0.00293,"percentile":0.20455}],"risk":0.16847499999999999,"urls":["https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv","https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length","https://nvd.nist.gov/vuln/detail/CVE-2026-42585"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-38f8-5428-x5cv","description":"Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding"},"relatedVulnerabilities":[{"id":"CVE-2026-42585","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42585","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42585","date":"2026-10-17","epss":0.00293,"percentile":0.20455}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42585","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-60147","versionConstraint":"< 1.8.0_502||>= 1.9, < 8.0.502||>= 12, < 17.0.20||>= 18, < 21.0.12||>= 22, < 25.0.4||>= 26, < 26.0.2||>= 9, < 11.0.32 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-60147","fix":{"state":"fixed","versions":["1.8.0_502","8.0.502","11.0.32","17.0.20","21.0.12","25.0.4","26.0.2"],"available":[{"date":"2026-08-15","kind":"first-observed","version":"1.8.0_502"},{"date":"2026-08-15","kind":"first-observed","version":"8.0.502"},{"date":"2026-08-15","kind":"first-observed","version":"17.0.20"},{"date":"2026-08-15","kind":"first-observed","version":"21.0.12"},{"date":"2026-08-15","kind":"first-observed","version":"25.0.4"},{"date":"2026-08-15","kind":"first-observed","version":"26.0.2"},{"date":"2026-08-15","kind":"first-observed","version":"11.0.32"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60147","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60147","date":"2026-10-17","epss":0.00287,"percentile":0.19859}],"risk":0.165025,"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60147","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"857fdbeb818a2cc6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"292e794b658d9b53","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.14.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.14.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.1","type":"java-archive","version":"2.14.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"268524b9056cae1211b9f1f52560ef19347f4d17","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.14.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.14.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"8eb601ecd919f845","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.17.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1","type":"java-archive","version":"2.17.1","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.17.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"ffe960256a789e68","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"61e6f8897d5a0493","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"363101a867c71a2c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"f8feb5e85c2a169d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"812db68f551b0416","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"3051772d593196d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"ad0e3c88248d64f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"b938fd22986ee151","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"b561e341f78d1ddb","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"f6deb16dd250346d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.0.0,<2.18.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-17","epss":0.00313,"percentile":0.22616}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-46968","versionConstraint":"< 1.8.0_502||>= 1.9, < 8.0.502||>= 12, < 17.0.20||>= 18, < 21.0.12||>= 22, < 25.0.4||>= 26, < 26.0.2||>= 9, < 11.0.32 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-46968","fix":{"state":"fixed","versions":["1.8.0_502","8.0.502","11.0.32","17.0.20","21.0.12","25.0.4","26.0.2"],"available":[{"date":"2026-08-15","kind":"first-observed","version":"1.8.0_502"},{"date":"2026-08-15","kind":"first-observed","version":"8.0.502"},{"date":"2026-08-15","kind":"first-observed","version":"17.0.20"},{"date":"2026-08-15","kind":"first-observed","version":"21.0.12"},{"date":"2026-08-15","kind":"first-observed","version":"25.0.4"},{"date":"2026-08-15","kind":"first-observed","version":"26.0.2"},{"date":"2026-08-15","kind":"first-observed","version":"11.0.32"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46968","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46968","date":"2026-10-17","epss":0.00291,"percentile":0.203}],"risk":0.158595,"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46968","description":"Vulnerability in Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-47021","versionConstraint":"< 1.8.0_502||>= 1.9, < 8.0.502||>= 12, < 17.0.20||>= 18, < 21.0.12||>= 22, < 25.0.4||>= 26, < 26.0.2||>= 9, < 11.0.32 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-47021","fix":{"state":"fixed","versions":["1.8.0_502","8.0.502","11.0.32","17.0.20","21.0.12","25.0.4","26.0.2"],"available":[{"date":"2026-08-15","kind":"first-observed","version":"1.8.0_502"},{"date":"2026-08-15","kind":"first-observed","version":"8.0.502"},{"date":"2026-08-15","kind":"first-observed","version":"17.0.20"},{"date":"2026-08-15","kind":"first-observed","version":"21.0.12"},{"date":"2026-08-15","kind":"first-observed","version":"25.0.4"},{"date":"2026-08-15","kind":"first-observed","version":"26.0.2"},{"date":"2026-08-15","kind":"first-observed","version":"11.0.32"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47021","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47021","date":"2026-10-17","epss":0.00305,"percentile":0.21774}],"risk":0.15707500000000002,"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47021","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-46917","versionConstraint":">= 12, < 17.0.20||>= 18, < 21.0.12||>= 22, < 25.0.4||>= 26, < 26.0.2||>= 9, < 11.0.32 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-46917","fix":{"state":"fixed","versions":["11.0.32","17.0.20","21.0.12","25.0.4","26.0.2"],"available":[{"date":"2026-08-15","kind":"first-observed","version":"17.0.20"},{"date":"2026-08-15","kind":"first-observed","version":"21.0.12"},{"date":"2026-08-15","kind":"first-observed","version":"25.0.4"},{"date":"2026-08-15","kind":"first-observed","version":"26.0.2"},{"date":"2026-08-15","kind":"first-observed","version":"11.0.32"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46917","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46917","date":"2026-10-17","epss":0.00289,"percentile":0.20107}],"risk":0.148835,"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46917","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-47027","versionConstraint":"< 1.8.0_502||>= 1.9, < 8.0.502||>= 12, < 17.0.20||>= 18, < 21.0.12||>= 22, < 25.0.4||>= 26, < 26.0.2||>= 9, < 11.0.32 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-47027","fix":{"state":"fixed","versions":["1.8.0_502","8.0.502","11.0.32","17.0.20","21.0.12","25.0.4","26.0.2"],"available":[{"date":"2026-08-15","kind":"first-observed","version":"1.8.0_502"},{"date":"2026-08-15","kind":"first-observed","version":"8.0.502"},{"date":"2026-08-15","kind":"first-observed","version":"17.0.20"},{"date":"2026-08-15","kind":"first-observed","version":"21.0.12"},{"date":"2026-08-15","kind":"first-observed","version":"25.0.4"},{"date":"2026-08-15","kind":"first-observed","version":"26.0.2"},{"date":"2026-08-15","kind":"first-observed","version":"11.0.32"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47027","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47027","date":"2026-10-17","epss":0.00289,"percentile":0.20107}],"risk":0.148835,"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47027","description":"Vulnerability in Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"f98dc620649d5042","cpes":["cpe:2.3:a:jonathan-hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jonathan_hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:org.jsoup:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.15.3:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.15.3","type":"java-archive","version":"1.15.3","language":"java","licenses":["https://jsoup.org/license"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jsoup-1.15.3.jar","manifestName":"","pomArtifactID":"jsoup","archiveDigests":[{"value":"f6e1d8a8819f854b681c8eaa57fd59a42329e10c","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jsoup-1.15.3.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jsoup-1.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pmhh-3w7g-xqp8","versionConstraint":">=1.14.3,<1.23.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pmhh-3w7g-xqp8","fix":{"state":"fixed","versions":["1.23.1"],"available":[{"date":"2026-08-07","kind":"first-observed","version":"1.23.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71497","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71497","date":"2026-10-17","epss":0.00296,"percentile":0.20787}],"risk":0.14356,"urls":["https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8","https://github.com/jhy/jsoup/issues/2538","https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pmhh-3w7g-xqp8","description":"jsoup: Cleaner may expose markup with custom raw-text elements"},"relatedVulnerabilities":[{"id":"CVE-2026-71497","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71497","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71497","date":"2026-10-17","epss":0.00296,"percentile":0.20787}],"urls":["https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","https://github.com/jhy/jsoup/issues/2538","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1","https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71497","description":"jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1."}]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12.1"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70907","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70907","fix":{"state":"fixed","versions":["1.8.0_504","8.0.504","11.0.32.1","17.0.20.1","21.0.12.1","25.0.4.1","26.0.2.1"],"available":[{"date":"2026-08-25","kind":"first-observed","version":"1.8.0_504"},{"date":"2026-08-25","kind":"first-observed","version":"8.0.504"},{"date":"2026-08-25","kind":"first-observed","version":"17.0.20.1"},{"date":"2026-08-25","kind":"first-observed","version":"21.0.12.1"},{"date":"2026-08-25","kind":"first-observed","version":"25.0.4.1"},{"date":"2026-08-25","kind":"first-observed","version":"26.0.2.1"},{"date":"2026-08-25","kind":"first-observed","version":"11.0.32.1"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70907","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-70907","date":"2026-10-17","epss":0.00278,"percentile":0.18917}],"risk":0.14317,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70907","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"696af17ee7206d7c","cpes":["cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.130.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.130.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.130.Final","type":"java-archive","version":"4.1.130.Final","language":"java","licenses":[],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar:io.netty:netty-codec-http","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/filtered-security-analytics-commons-1.0.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c42-7qj2-3j46","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.130.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c42-7qj2-3j46","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-08-18","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"risk":0.14145,"urls":["https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","description":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite"},"relatedVulnerabilities":[{"id":"CVE-2026-59903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"urls":["https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"c180d5a25918e7f4","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c42-7qj2-3j46","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c42-7qj2-3j46","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-08-18","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"risk":0.14145,"urls":["https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","description":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite"},"relatedVulnerabilities":[{"id":"CVE-2026-59903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"urls":["https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"d1c97ba0b1128983","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c42-7qj2-3j46","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c42-7qj2-3j46","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-08-18","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"risk":0.14145,"urls":["https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","description":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite"},"relatedVulnerabilities":[{"id":"CVE-2026-59903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"urls":["https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"42320dee29e4ce1c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/transport-netty4/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c42-7qj2-3j46","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c42-7qj2-3j46","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-08-18","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"risk":0.14145,"urls":["https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","description":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite"},"relatedVulnerabilities":[{"id":"CVE-2026-59903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"urls":["https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"8d4f62094c81050c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c42-7qj2-3j46","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c42-7qj2-3j46","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-08-18","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"risk":0.14145,"urls":["https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","description":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite"},"relatedVulnerabilities":[{"id":"CVE-2026-59903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"urls":["https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"e61145a455d661f7","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.1.135.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.1.135.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.1.135.Final","type":"java-archive","version":"4.1.135.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"69d785784208bae296fa74d802772687c6947754","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/netty-codec-http-4.1.135.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c42-7qj2-3j46","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.1.135.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c42-7qj2-3j46","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-08-18","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"risk":0.14145,"urls":["https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","description":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite"},"relatedVulnerabilities":[{"id":"CVE-2026-59903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-17","epss":0.00246,"percentile":0.14748}],"urls":["https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"cbf268e55fa6a9b3","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.10.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.10.1","type":"java-archive","version":"1.10.1","language":"java","licenses":["Apache License, Version 2.0"],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"f541d7f910fe3d76f38f799c507c48cc81b12ecb","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-343h-94h5-c4wr","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.10.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-343h-94h5-c4wr","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-10-17","epss":0.00339,"percentile":0.25735}],"risk":0.11356499999999997,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr","https://nvd.nist.gov/vuln/detail/CVE-2026-106449","https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-343h-94h5-c4wr","description":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError"},"relatedVulnerabilities":[{"id":"CVE-2026-106449","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-10-17","epss":0.00339,"percentile":0.25735}],"urls":["https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-47059","versionConstraint":"< 1.8.0_502||>= 1.9, < 8.0.502||>= 12, < 17.0.20||>= 18, < 21.0.12||>= 22, < 25.0.4||>= 26, < 26.0.2||>= 9, < 11.0.32 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-47059","fix":{"state":"fixed","versions":["1.8.0_502","8.0.502","11.0.32","17.0.20","21.0.12","25.0.4","26.0.2"],"available":[{"date":"2026-08-15","kind":"first-observed","version":"1.8.0_502"},{"date":"2026-08-15","kind":"first-observed","version":"8.0.502"},{"date":"2026-08-15","kind":"first-observed","version":"17.0.20"},{"date":"2026-08-15","kind":"first-observed","version":"21.0.12"},{"date":"2026-08-15","kind":"first-observed","version":"25.0.4"},{"date":"2026-08-15","kind":"first-observed","version":"26.0.2"},{"date":"2026-08-15","kind":"first-observed","version":"11.0.32"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47059","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47059","date":"2026-10-17","epss":0.00306,"percentile":0.21841}],"risk":0.10250999999999999,"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47059","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12.1"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-60589","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-60589","fix":{"state":"fixed","versions":["1.8.0_504","8.0.504","11.0.32.1","17.0.20.1","21.0.12.1","25.0.4.1","26.0.2.1"],"available":[{"date":"2026-08-25","kind":"first-observed","version":"1.8.0_504"},{"date":"2026-08-25","kind":"first-observed","version":"8.0.504"},{"date":"2026-08-25","kind":"first-observed","version":"17.0.20.1"},{"date":"2026-08-25","kind":"first-observed","version":"21.0.12.1"},{"date":"2026-08-25","kind":"first-observed","version":"25.0.4.1"},{"date":"2026-08-25","kind":"first-observed","version":"26.0.2.1"},{"date":"2026-08-25","kind":"first-observed","version":"11.0.32.1"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60589","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60589","date":"2026-10-17","epss":0.00265,"percentile":0.17206}],"risk":0.08877499999999999,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60589","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"746fd698ae624d49","cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"name":"openjdk","purl":"pkg:generic/oracle/openjdk@21.0.11%2B10-LTS?repository_url=https%3A%2F%2Fgithub.com%2Fadoptium%2Fjdk21u.git","type":"binary","version":"21.0.11+10-LTS","language":"","licenses":[],"metadata":{"release":{"fullVersion":"21.0.11+10-LTS","javaVersion":"21.0.11","semanticVersion":"21.0.11+10","javaRuntimeVersion":"21.0.11+10-LTS"}},"locations":[{"path":"/usr/share/opensearch/jdk/release","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/jdk/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"21.0.12"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-47010","versionConstraint":"< 1.8.0_502||>= 1.9, < 8.0.502||>= 12, < 17.0.20||>= 18, < 21.0.12||>= 22, < 25.0.4||>= 26, < 26.0.2||>= 9, < 11.0.32 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.11:*:*:*:*:*:*:*"],"package":{"name":"openjdk","version":"21.0.11+10-LTS"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-47010","fix":{"state":"fixed","versions":["1.8.0_502","8.0.502","11.0.32","17.0.20","21.0.12","25.0.4","26.0.2"],"available":[{"date":"2026-08-15","kind":"first-observed","version":"1.8.0_502"},{"date":"2026-08-15","kind":"first-observed","version":"8.0.502"},{"date":"2026-08-15","kind":"first-observed","version":"17.0.20"},{"date":"2026-08-15","kind":"first-observed","version":"21.0.12"},{"date":"2026-08-15","kind":"first-observed","version":"25.0.4"},{"date":"2026-08-15","kind":"first-observed","version":"26.0.2"},{"date":"2026-08-15","kind":"first-observed","version":"11.0.32"}]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47010","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47010","date":"2026-10-17","epss":0.00254,"percentile":0.15789}],"risk":0.08509,"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47010","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"278bb407d09a0edb","cpes":["cpe:2.3:a:org.jline.reader:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.reader:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-reader:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-reader:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_reader:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_reader:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.reader:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-reader:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_reader:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:reader:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:reader:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:reader:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:reader:3.27.1:*:*:*:*:*:*:*"],"name":"jline-reader","purl":"pkg:maven/org.jline/jline-reader@3.27.1","type":"java-archive","version":"3.27.1","language":"java","licenses":["https://opensource.org/licenses/BSD-3-Clause"],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-reader-3.27.1.jar","manifestName":"","pomArtifactID":"jline-reader","archiveDigests":[{"value":"d7e63702fc88c4c838d333a90f3a2db4d5b88457","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jline-reader-3.27.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-reader-3.27.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5q95-hrpc-m3w3","versionConstraint":">=3.0.0,<3.30.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-reader","version":"3.27.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5q95-hrpc-m3w3","fix":{"state":"fixed","versions":["3.30.15"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"3.30.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77420","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77420","date":"2026-10-17","epss":0.00123,"percentile":0.01861}],"risk":0.06457500000000001,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5q95-hrpc-m3w3","description":"JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable"},"relatedVulnerabilities":[{"id":"CVE-2026-77420","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77420","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77420","date":"2026-10-17","epss":0.00123,"percentile":0.01861}],"urls":["https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77420","description":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1."}]},{"artifact":{"id":"cbf268e55fa6a9b3","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.10.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.10.1","type":"java-archive","version":"1.10.1","language":"java","licenses":["Apache License, Version 2.0"],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"f541d7f910fe3d76f38f799c507c48cc81b12ecb","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.10.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mcr4-qmvw-px4g","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.10.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mcr4-qmvw-px4g","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106451","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106451","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106451","date":"2026-10-17","epss":0.00083,"percentile":0.00225}],"risk":0.061419999999999995,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g","https://nvd.nist.gov/vuln/detail/CVE-2026-106451","https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mcr4-qmvw-px4g","description":"yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user"},"relatedVulnerabilities":[{"id":"CVE-2026-106451","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106451","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106451","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106451","date":"2026-10-17","epss":0.00083,"percentile":0.00225}],"urls":["https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106451","description":"yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"abbcb1f3d6e523a1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","type":"java-archive","version":"2.18.2","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"deef8697b92141fb6caf7aa86966cff4eec9b04f","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"b938fd22986ee151","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"ad0e3c88248d64f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"61e6f8897d5a0493","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"f6deb16dd250346d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"b561e341f78d1ddb","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"ffe960256a789e68","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"363101a867c71a2c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"3051772d593196d6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"f8feb5e85c2a169d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]},{"artifact":{"id":"812db68f551b0416","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.8:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.8:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8","type":"java-archive","version":"2.18.8","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"4d2aa1ce8a37aefc6f65438f18a8d6d61b2a7450","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","layerID":"sha256:a1fa96ecf23b176c807e1ee313c10f077dd82217b45f54086ed5048f8645a2b2","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.18.0,<=2.18.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.8"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.18.9"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.18.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-10-19T05:09:17.033Z","grype_db_version":"2026-10-18T06:27:17.000Z"}