{"grype_matches":[{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.80.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p93r-85wp-75v3","versionConstraint":">=1.71,<1.80.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p93r-85wp-75v3","fix":{"state":"fixed","versions":["1.80.2"],"available":[{"date":"2026-06-19","kind":"first-observed","version":"1.80.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:P/AU:Y/U:Red","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5598","date":"2026-10-20","epss":0.0096,"percentile":0.60955}],"risk":0.7872,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5598","https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5","https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87","https://github.com/bcgit/bc-java/wiki/CVE-2026-5598","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p93r-85wp-75v3","description":"Bouncy Castle Has Covert Timing Channel Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-5598","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Red","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5598","cwe":"CWE-385","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5598","date":"2026-10-20","epss":0.0096,"percentile":0.60955}],"urls":["https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5","https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598","https://access.redhat.com/errata/RHSA-2026:12267","https://access.redhat.com/errata/RHSA-2026:12269","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/security/cve/CVE-2026-5598","https://bugzilla.redhat.com/show_bug.cgi?id=2458635","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5598","description":"Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).\n\n This vulnerability is associated with program files FrodoEngine.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"bfa97feac2ad6149","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty-security:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty-security:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty_security:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty_security:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty-security:jetty:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_security:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty_security:jetty:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.58.v20250814:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:9.4.58.v20250814:*:*:*:*:*:*:*"],"name":"jetty-security","purl":"pkg:maven/org.eclipse.jetty/jetty-security@9.4.58.v20250814","type":"java-archive","version":"9.4.58.v20250814","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/share/opensearch/plugins/opensearch-skills/spark-core_2.13-3.5.8.jar:org.eclipse.jetty:jetty-security","manifestName":"","pomArtifactID":"jetty-security","archiveDigests":null},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-skills/spark-core_2.13-3.5.8.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-skills/spark-core_2.13-3.5.8.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.4.63"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fvj-hgj9-j2gr","versionConstraint":">=9.4.0.v20161208,<=9.4.58.v20250814 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-security","version":"9.4.58.v20250814"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2fvj-hgj9-j2gr","fix":{"state":"fixed","versions":["9.4.63"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"9.4.63"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-10-20","epss":0.00632,"percentile":0.49376}],"risk":0.51192,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://github.com/jetty/jetty.project/issues/15136","https://github.com/jetty/jetty.project/pull/15160","https://github.com/jetty/jetty.project/pull/15183","https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d","https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d","https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36","https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fvj-hgj9-j2gr","description":"Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution"},"relatedVulnerabilities":[{"id":"CVE-2026-10050","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-10-20","epss":0.00632,"percentile":0.49376}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10050","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords."}]},{"artifact":{"id":"ee1169314b89a054","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"20d838fe7d6c5cf4","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ec71c9c1454cc6e2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f0c8056337e97b62","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"a5d41cb5273a85f3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"388087d7efa79d23","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"4b26a88d6a30f0f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"a4eaf2530773be7b","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"1f68b27d734f37dc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"4169f822a2e29111","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"23b7ced95f4caec6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"5a11d710b1e1cc14","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"af4403eade16296f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"bffb46d146ab7d51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-20","epss":0.00581,"percentile":0.46747}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"c84d097866233af0","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/jackson-core-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/lib/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.17.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-20","epss":0.00546,"percentile":0.44702}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-20","epss":0.00546,"percentile":0.44702}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"77a03bd7dcf45cf6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.17.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-20","epss":0.00546,"percentile":0.44702}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-20","epss":0.00546,"percentile":0.44702}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"39fd93de8bca0b2a","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.17.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-20","epss":0.00546,"percentile":0.44702}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-20","epss":0.00546,"percentile":0.44702}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-20","epss":0.0043,"percentile":0.35919}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-20","epss":0.0043,"percentile":0.35919}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"58efe9c47e042bec","cpes":["cpe:2.3:a:bcpkix-jdk15to18:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix-jdk15to18:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk15to18:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk15to18:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcpkix-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcpkix-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcpkix-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcpkix-jdk15to18","archiveDigests":[{"value":"1998a94bba4d3568b39348b168a2312079b6eb2a","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcpkix-jdk15to18-1.79.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcpkix-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wg6q-6289-32hp","versionConstraint":">=1.49,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcpkix-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wg6q-6289-32hp","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-17","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-20","epss":0.00687,"percentile":0.51841}],"risk":0.388155,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5588","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wg6q-6289-32hp","description":"Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules"},"relatedVulnerabilities":[{"id":"CVE-2026-5588","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-20","epss":0.00687,"percentile":0.51841}],"urls":["https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-5588","https://bugzilla.redhat.com/show_bug.cgi?id=2458634","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5588.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5588","description":"Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).\n\n This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11."}]},{"artifact":{"id":"5a11d710b1e1cc14","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"a4eaf2530773be7b","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ec71c9c1454cc6e2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f0c8056337e97b62","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"1f68b27d734f37dc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"20d838fe7d6c5cf4","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"388087d7efa79d23","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"a5d41cb5273a85f3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ee1169314b89a054","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"23b7ced95f4caec6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"4169f822a2e29111","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"bffb46d146ab7d51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"af4403eade16296f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"4b26a88d6a30f0f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-20","epss":0.00717,"percentile":0.53008}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"72911a8a2331d9b6","cpes":["cpe:2.3:a:org.jline.builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:builtins:3.27.1:*:*:*:*:*:*:*"],"name":"jline-builtins","purl":"pkg:maven/org.jline/jline-builtins@3.27.1","type":"java-archive","version":"3.27.1","language":"java","licenses":["https://opensource.org/licenses/BSD-3-Clause"],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","manifestName":"","pomArtifactID":"jline-builtins","archiveDigests":[{"value":"de8d19e5fdd7b932f3d8e23ecaa0c24a4897efa7","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r2xf-8xr9-62gw","versionConstraint":">=3.0.0,<3.30.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-builtins","version":"3.27.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r2xf-8xr9-62gw","fix":{"state":"fixed","versions":["3.30.15"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"3.30.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77422","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77422","date":"2026-10-20","epss":0.00496,"percentile":0.41335}],"risk":0.372,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r2xf-8xr9-62gw","description":"JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping"},"relatedVulnerabilities":[{"id":"CVE-2026-77422","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77422","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77422","date":"2026-10-20","epss":0.00496,"percentile":0.41335}],"urls":["https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77422","description":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1."}]},{"artifact":{"id":"c84d097866233af0","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/jackson-core-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/lib/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-20","epss":0.00492,"percentile":0.41052}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-20","epss":0.00492,"percentile":0.41052}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"39fd93de8bca0b2a","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-20","epss":0.00492,"percentile":0.41052}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-20","epss":0.00492,"percentile":0.41052}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"77a03bd7dcf45cf6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-20","epss":0.00492,"percentile":0.41052}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-20","epss":0.00492,"percentile":0.41052}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-20","epss":0.00442,"percentile":0.37069}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-20","epss":0.00442,"percentile":0.37069}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"1f68b27d734f37dc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"388087d7efa79d23","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"20d838fe7d6c5cf4","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"ec71c9c1454cc6e2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"f0c8056337e97b62","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"ee1169314b89a054","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"a5d41cb5273a85f3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"23b7ced95f4caec6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"5a11d710b1e1cc14","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"af4403eade16296f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"bffb46d146ab7d51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"4169f822a2e29111","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"a4eaf2530773be7b","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"4b26a88d6a30f0f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"ee1169314b89a054","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"a5d41cb5273a85f3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"ec71c9c1454cc6e2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"388087d7efa79d23","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"f0c8056337e97b62","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"1f68b27d734f37dc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"4b26a88d6a30f0f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"20d838fe7d6c5cf4","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"23b7ced95f4caec6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"5a11d710b1e1cc14","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"af4403eade16296f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"bffb46d146ab7d51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"4169f822a2e29111","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"a4eaf2530773be7b","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-20","epss":0.0045,"percentile":0.37825}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-574f-3g2m-x479","versionConstraint":">=1.59,<=1.80.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-574f-3g2m-x479","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-14813","date":"2026-10-20","epss":0.0032,"percentile":0.23512}],"risk":0.27840000000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-14813","https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3","https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json","https://bugzilla.redhat.com/show_bug.cgi?id=2458640","https://access.redhat.com/security/cve/CVE-2025-14813","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-574f-3g2m-x479","description":"Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks"},"relatedVulnerabilities":[{"id":"CVE-2025-14813","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-14813","date":"2026-10-20","epss":0.0032,"percentile":0.23512}],"urls":["https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3","https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2025-14813","https://bugzilla.redhat.com/show_bug.cgi?id=2458640","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14813","description":": Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).\n\n This vulnerability is associated with program files G3413CTRBlockCipher.\n\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"71b2408de5a052a2","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.79:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.79:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.79","type":"java-archive","version":"1.79","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"ffb3ff552ca56ac4af9a3927ebe1388f900ab283","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/bcprov-jdk15to18-1.79.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c3fc-8qff-9hwx","versionConstraint":">=1.74,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.79"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c3fc-8qff-9hwx","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-18","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-20","epss":0.00527,"percentile":0.43526}],"risk":0.276675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-0636","https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c3fc-8qff-9hwx","description":"Bouncy Castle has an LDAP injection"},"relatedVulnerabilities":[{"id":"CVE-2026-0636","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-20","epss":0.00527,"percentile":0.43526}],"urls":["https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-0636","https://bugzilla.redhat.com/show_bug.cgi?id=2458641","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0636","description":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\n\n This vulnerability is associated with program files LDAPStoreHelper.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"ee1169314b89a054","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"a4eaf2530773be7b","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"23b7ced95f4caec6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"a5d41cb5273a85f3","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"1f68b27d734f37dc","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security-analytics/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"f0c8056337e97b62","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"ec71c9c1454cc6e2","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"af4403eade16296f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"20d838fe7d6c5cf4","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"bffb46d146ab7d51","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"4169f822a2e29111","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-neural-search/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"5a11d710b1e1cc14","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"4b26a88d6a30f0f8","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-flow-framework/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"388087d7efa79d23","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-20","epss":0.00529,"percentile":0.43619}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"72911a8a2331d9b6","cpes":["cpe:2.3:a:org.jline.builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:builtins:builtins:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:builtins:3.27.1:*:*:*:*:*:*:*"],"name":"jline-builtins","purl":"pkg:maven/org.jline/jline-builtins@3.27.1","type":"java-archive","version":"3.27.1","language":"java","licenses":["https://opensource.org/licenses/BSD-3-Clause"],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","manifestName":"","pomArtifactID":"jline-builtins","archiveDigests":[{"value":"de8d19e5fdd7b932f3d8e23ecaa0c24a4897efa7","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-builtins-3.27.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ph9c-7hw9-vhhw","versionConstraint":">=3.0.0,<3.30.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-builtins","version":"3.27.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ph9c-7hw9-vhhw","fix":{"state":"fixed","versions":["3.30.15"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"3.30.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77421","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77421","date":"2026-10-20","epss":0.00434,"percentile":0.36327}],"risk":0.24955,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ph9c-7hw9-vhhw","description":"JLine: ReDoS in Nano Editor Regex Search Mode"},"relatedVulnerabilities":[{"id":"CVE-2026-77421","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77421","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77421","date":"2026-10-20","epss":0.00434,"percentile":0.36327}],"urls":["https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77421","description":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1."}]},{"artifact":{"id":"fb85c05c1477601a","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4v53-57pg-c464","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4v53-57pg-c464","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-10-20","epss":0.00371,"percentile":0.29632}],"risk":0.191065,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464","https://nvd.nist.gov/vuln/detail/CVE-2026-106452","https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4v53-57pg-c464","description":"yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header"},"relatedVulnerabilities":[{"id":"CVE-2026-106452","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-10-20","epss":0.00371,"percentile":0.29632}],"urls":["https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106452","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"fb85c05c1477601a","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gm45-99xc-r7wv","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gm45-99xc-r7wv","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"risk":0.191065,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv","https://nvd.nist.gov/vuln/detail/CVE-2026-106450","https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gm45-99xc-r7wv","description":"yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs"},"relatedVulnerabilities":[{"id":"CVE-2026-106450","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"urls":["https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106450","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"fb85c05c1477601a","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cx8-rjf8-pr8g","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cx8-rjf8-pr8g","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-10-20","epss":0.00371,"percentile":0.29629}],"risk":0.191065,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g","https://nvd.nist.gov/vuln/detail/CVE-2026-106453","https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cx8-rjf8-pr8g","description":"yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError"},"relatedVulnerabilities":[{"id":"CVE-2026-106453","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-10-20","epss":0.00371,"percentile":0.29629}],"urls":["https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106453","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"fb85c05c1477601a","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-343h-94h5-c4wr","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-343h-94h5-c4wr","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-10-20","epss":0.00339,"percentile":0.25852}],"risk":0.11356499999999997,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr","https://nvd.nist.gov/vuln/detail/CVE-2026-106449","https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-343h-94h5-c4wr","description":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError"},"relatedVulnerabilities":[{"id":"CVE-2026-106449","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-10-20","epss":0.00339,"percentile":0.25852}],"urls":["https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"278bb407d09a0edb","cpes":["cpe:2.3:a:org.jline.reader:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.reader:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-reader:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-reader:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_reader:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_reader:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline.reader:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-reader:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_reader:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:reader:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:reader:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:reader:reader:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:reader:3.27.1:*:*:*:*:*:*:*"],"name":"jline-reader","purl":"pkg:maven/org.jline/jline-reader@3.27.1","type":"java-archive","version":"3.27.1","language":"java","licenses":["https://opensource.org/licenses/BSD-3-Clause"],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-reader-3.27.1.jar","manifestName":"","pomArtifactID":"jline-reader","archiveDigests":[{"value":"d7e63702fc88c4c838d333a90f3a2db4d5b88457","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-ml/jline-reader-3.27.1.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-ml/jline-reader-3.27.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5q95-hrpc-m3w3","versionConstraint":">=3.0.0,<3.30.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-reader","version":"3.27.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5q95-hrpc-m3w3","fix":{"state":"fixed","versions":["3.30.15"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"3.30.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77420","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77420","date":"2026-10-20","epss":0.00123,"percentile":0.01875}],"risk":0.06457500000000001,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5q95-hrpc-m3w3","description":"JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable"},"relatedVulnerabilities":[{"id":"CVE-2026-77420","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77420","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77420","date":"2026-10-20","epss":0.00123,"percentile":0.01875}],"urls":["https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77420","description":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1."}]},{"artifact":{"id":"fb85c05c1477601a","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","layerID":"sha256:11c69e67d69553bcfc0b5de07f821d2fdb0a0b50e8e94c5cedbb774d935e3fbd","accessPath":"/usr/share/opensearch/plugins/opensearch-security/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mcr4-qmvw-px4g","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mcr4-qmvw-px4g","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106451","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106451","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106451","date":"2026-10-20","epss":0.00083,"percentile":0.00226}],"risk":0.061419999999999995,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g","https://nvd.nist.gov/vuln/detail/CVE-2026-106451","https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mcr4-qmvw-px4g","description":"yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user"},"relatedVulnerabilities":[{"id":"CVE-2026-106451","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106451","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106451","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106451","date":"2026-10-20","epss":0.00083,"percentile":0.00226}],"urls":["https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106451","description":"yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4."}]}],"grade":"F","score":"0.00","as_of":"2026-10-21T08:06:06.825Z","grype_db_version":"2026-10-21T06:31:02.000Z"}