StackRadar

CVE-2026-18401

Medium

Advisory

Published 28 Feb 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
307
of 17,781 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

Carried by container images the latest versions of 307 of 17,781 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
jackson-coremaven2.15.0, 2.15.2, 2.15.3, 2.15.4+21 more2.18.6, 2.21.1, 3.1.0314
OSV records
GHSA-72hv-8253-57qq

Charts affected

307 by stars
ChartLatestAffected imagesRadar Score
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
vespaengine/vespa:8.526.1569b160f58211
jackson-core@2.18.3
2.18.6

Open the chart page →

6,338
raspberrymaticopenccuVerified publisher3.83.61 of 1See more

raspberrymatic openccu 3.83.6

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
jackson-core@2.15.2
2.18.6

Open the chart page →

2,421
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
jackson-core@2.18.3
2.18.6

Open the chart page →

7,792
operatonoperatonVerified publisher1.0.51 of 1See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
operaton/operaton:1.0.0-beta-4b35867ffe4d8
jackson-core@2.18.3
2.18.6

Open the chart page →

2,003
dfdeweyosdfir-infrastructureVerified publisher1.0.01 of 3See more

dfdewey osdfir-infrastructure 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.12.0645d3d9390ad
jackson-core@2.16.1
2.18.6

Open the chart page →

1,190
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
opensearchproject/opensearch:3.1.0474ea3fdf25d
jackson-core@2.18.2
2.18.6

Open the chart page →

71,208
timesketchosdfir-infrastructureVerified publisher1.0.81 of 6See more

timesketch osdfir-infrastructure 1.0.8

1 of the 6 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.14.0466a49f379bb
jackson-core@2.17.0
2.18.6

Open the chart page →

1,753
keycloakpascaliskeVerified publisher0.2.01 of 1See more

keycloak pascaliske 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.0.74388e2379b7e
jackson-core@2.17.2
2.18.6

Open the chart page →

2,097
flink-kubernetes-operatorpresto-loadbalancer1.10.01 of 1See more

flink-kubernetes-operator presto-loadbalancer 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/apache/flink-kubernetes-operator:c703255e9c2ce635b89
jackson-core@2.15.0
2.18.6

Open the chart page →

3,277
trinopresto-loadbalancer0.2.101 of 2See more

trino presto-loadbalancer 0.2.10

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
trinodb/trino:4796af989b0846d
jackson-core@2.20.1
2.21.1

Open the chart page →

2,264
rada-platformrada-platform0.1.02 of 7See more

rada-platform rada-platform 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
jackson-core@2.17.1
2.18.6
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
jackson-core@2.17.2
2.18.6

Open the chart page →

21,211
app-configradar-baseVerified publisher1.7.21 of 1See more

app-config radar-base 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-app-config/radar-app-config:0.6.24431db7b486b
jackson-core@2.20.2
2.21.1

Open the chart page →

2,036
catalog-serverradar-baseVerified publisher0.9.31 of 1See more

catalog-server radar-base 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-schemas/radar-schemas-tools:0.8.16c442e8bfe6b4
jackson-core@2.20.2
2.21.1

Open the chart page →

2,418
data-dashboard-backendradar-baseVerified publisher0.6.21 of 1See more

data-dashboard-backend radar-base 0.6.2

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-data-dashboard-backend/radar-data-dashboard-backend:0.2.4d1e55350923c
jackson-core@2.20.2
2.21.1

Open the chart page →

2,019
management-portalradar-baseVerified publisher1.7.01 of 1See more

management-portal radar-base 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
jackson-core@2.16.1
2.18.6

Open the chart page →

3,182
radar-gatewayradar-baseVerified publisher1.9.01 of 2See more

radar-gateway radar-base 1.9.0

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
jackson-core@2.20.2
2.21.1

Open the chart page →

2,284
radar-integrationradar-baseVerified publisher0.9.01 of 1See more

radar-integration radar-base 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
radarbase/radar-redcapintegration:1.0.6fcd973d4796d
jackson-core@2.16.1
2.18.6

Open the chart page →

2,855
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jackson-core@2.18.3
2.18.6

Open the chart page →

4,219
radar-outputradar-baseVerified publisher1.2.101 of 1See more

radar-output radar-base 1.2.10

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
jackson-core@2.20.2
2.21.1

Open the chart page →

2,465
radar-push-endpointradar-baseVerified publisher0.6.81 of 2See more

radar-push-endpoint radar-base 0.6.8

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
radarbase/radar-push-endpoint:0.4.0e1758508e033
jackson-core@2.16.1
2.18.6

Open the chart page →

3,018
radar-upload-connect-backendradar-baseVerified publisher0.9.11 of 1See more

radar-upload-connect-backend radar-base 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-backend:0.6.46a04b43b8d9a
jackson-core@2.19.2
2.21.1

Open the chart page →

2,532
strimzi-kafka-operatorradar-baseVerified publisher0.46.01 of 1See more

strimzi-kafka-operator radar-base 0.46.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jackson-core@2.18.3
2.18.6

Open the chart page →

1,951
iparedhat-cop1.3.91 of 1See more

ipa redhat-cop 1.3.9

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
quay.io/freeipa/freeipa-server:fedora-39-4.11.1d422ee50c2c3
jackson-core@2.15.2
2.18.6

Open the chart page →

951
sonarquberedhat-cop0.1.131 of 1See more

sonarqube redhat-cop 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
library/sonarqube:10.7.0-community0842dcd4c8f8
jackson-core@2.17.1
2.18.6

Open the chart page →

4,203
kafkasb-helm-charts0.3.01 of 2See more

kafka sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
provectuslabs/kafka-ui:latest8f2ff02d64b0
jackson-core@2.15.2
2.18.6

Open the chart page →

1,597
keycloaksb-helm-charts0.3.01 of 2See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.0.6a93d22e13b86
jackson-core@2.17.2
2.18.6

Open the chart page →

2,590
smartsuggestsearchhub0.1.01 of 1See more

smartsuggest searchhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
commerceexperts/searchhub-smartsuggest-service:1.3.0341eebe7239b
jackson-core@2.15.3
2.18.6

Open the chart page →

1,235
guacamolesergiotocaliniVerified publisher1.0.01 of 2See more

guacamole sergiotocalini 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
guacamole/guacamole:1.5.50f62f6d17ab3
jackson-core@2.17.0
2.18.6

Open the chart page →

5,456
keycloaksikalabs0.1.01 of 1See more

keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.3.36a7217a100bd
jackson-core@2.18.2
2.18.6

Open the chart page →

1,690
strimzi-user-operatorspartan0.4.01 of 1See more

strimzi-user-operator spartan 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-core@2.16.2
2.18.6

Open the chart page →

1,836
retail-store-sample-cart-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-cart-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-cart:1.3.05d767569c976
jackson-core@2.19.2
2.21.1

Open the chart page →

1,068
retail-store-sample-orders-chartstacksimplifyVerified publisher2.0.01 of 1See more

retail-store-sample-orders-chart stacksimplify 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-orders:1.3.0e85f034bcf48
jackson-core@2.19.2
2.21.1

Open the chart page →

1,223
retail-store-sample-ui-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-ui-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-ui:1.3.0ce3f2e935eb3
jackson-core@2.19.2
2.21.1

Open the chart page →

836
jenkinsstakaterVerified publisher0.21.01 of 1See more

jenkins stakater 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-core@2.20.1
2.21.1

Open the chart page →

2,476
teku-validatorstakewise4.3.21 of 2See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
consensys/teku:25.4.1bf6ecd2ea716
jackson-core@2.18.3
2.18.6

Open the chart page →

3,153
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
jackson-core@2.15.0
2.18.6

Open the chart page →

1,827
wonder-mesh-netstrrl-helm2026.629.01 of 3See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.009a381c715ab
jackson-core@2.17.2
2.18.6

Open the chart page →

5,063
netforge-besvtechVerified publisher0.0.21 of 3See more

netforge-be svtech 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
conductoross/conductor:3.31.09fba127693e6
jackson-core@2.17.0
2.18.6

Open the chart page →

4,674
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
jackson-core@2.15.0
2.18.6

Open the chart page →

18,756
languagetool-serverszpadel-chartsVerified publisher0.4.01 of 1See more

languagetool-server szpadel-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
ghcr.io/szpadel/languagetool-server:6.568fdab22b2a9
jackson-core@2.17.2
2.18.6

Open the chart page →

808
jenkinstnh2.7.11 of 2See more

jenkins tnh 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-core@2.20.1
2.21.1

Open the chart page →

4,423
togglr-backendtogglrVerified publisher1.0.01 of 1See more

togglr-backend togglr 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
gdrocha/togglr-backend:1.0.0d5ae64e83d4c
jackson-core@2.15.3
2.18.6

Open the chart page →

3,221
configservertwomartensVerified publisher0.2.01 of 1See more

configserver twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
2martens/configserver:latestbf1cdb80239d
jackson-core@2.17.2
2.18.6

Open the chart page →

2,144
timetabletwomartensVerified publisher0.2.01 of 1See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
2martens/timetable:latestbd1ba6ab84c9
jackson-core@2.19.2
2.21.1

Open the chart page →

1,527
wahlrechttwomartensVerified publisher0.3.01 of 1See more

wahlrecht twomartens 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
2martens/wahlrecht:latestba2c3040dab0
jackson-core@2.19.2
2.21.1

Open the chart page →

1,689
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
jackson-core@2.16.0
2.18.6

Open the chart page →

1,733
opencloudunxwaresVerified publisher0.2.32 of 13See more

opencloud unxwares 0.2.3

2 of the 13 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
jackson-core@2.17.0
2.18.6
quay.io/keycloak/keycloak:26.1.4044a457e0498
jackson-core@2.17.2
2.18.6

Open the chart page →

45,239
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.49c344d2b1757
jackson-core@2.18.2
2.18.6

Open the chart page →

5,484
drillwearefrank1.3.61 of 3See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
jackson-core@2.15.2
2.18.6

Open the chart page →

9,397
jenkinswebencryptor1.9.181 of 1See more

jenkins webencryptor 1.9.18

1 of the 1 container images this version deploys carry CVE-2026-18401.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-core@2.20.1
2.21.1

Open the chart page →

2,476

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
featurehub/edge:1.9.198ad426737f6
jackson-core@2.17.2
2.18.6
1
featurehub/mr:1.9.1477d8bf771a9
jackson-core@2.17.2
2.18.6
1
flowable/flowable-rest:7.1.0b7ae287502cd
jackson-core@2.17.2
2.18.6
1
folioci/edge-connexion:latestb4863d135524
jackson-core@2.18.2
2.18.6
1
folioci/edge-ncip:lateste760dbb81d1a
jackson-core@2.18.2
2.18.6
1
folioci/edge-oai-pmh:latesteedfcbc29792
jackson-core@2.18.2
2.18.6
1
folioci/edge-patron:latest682b852e056d
jackson-core@2.18.2
2.18.6
1
folioci/edge-rtac:latest15ef73b1abd0
jackson-core@3.0.4
3.1.0
1
folioci/mod-authtoken:latest995a25a33133
jackson-core@2.16.1
2.18.6
1
folioci/mod-courses:latest68ca414f5596
jackson-core@2.18.2
2.18.6
1
folioci/mod-data-export:latest0cc86bf09755
jackson-core@3.0.4
3.1.0
1
folioci/mod-data-export-spring:latestf1d7caf4544b
jackson-core@3.0.4
3.1.0
1
folioci/mod-data-export-worker:latest1ad1811c9b37
jackson-core@2.20.2
2.21.1
1
folioci/mod-ebsconet:latest3ae8cb99daa3
jackson-core@2.20.2
2.21.1
1
folioci/mod-email:latest79ea8e2e7ebf
jackson-core@2.18.2
2.18.6
1
folioci/mod-eusage-reports:latest15de67587091
jackson-core@2.18.2
2.18.6
1
folioci/mod-feesfines:latestfe3a7049f2fb
jackson-core@2.18.2
2.18.6
1
folioci/mod-gobi:latestc58c989dac44
jackson-core@2.20.1
2.21.1
1
folioci/mod-inventory-update:latestba84812b4d58
jackson-core@2.18.2
2.18.6
1
folioci/mod-ldp:latestb55696fd9065
jackson-core@2.15.4
2.18.6
1
folioci/mod-login:latest88de493f86db
jackson-core@2.16.1
2.18.6
1
folioci/mod-ncip:latest8ed83674352b
jackson-core@2.18.2
2.18.6
1
folioci/mod-oai-pmh:latest5cd5ef063f2a
jackson-core@2.18.2
2.18.6
1
folioci/mod-patron:latest5f213acfe2f8
jackson-core@2.18.2
2.18.6
1
folioci/mod-remote-storage:latest4f12177123dc
jackson-core@2.17.2
2.18.6
1
folioci/mod-rtac:latestc959b2d6142f
jackson-core@2.18.2
2.18.6
1
folioci/mod-sender:latestd88a675dddf0
jackson-core@2.18.2
2.18.6
1
folioci/mod-template-engine:latestd105c585da30
jackson-core@2.18.2
2.18.6
1
folioci/mod-users-bl:latest4e2d96c9340d
jackson-core@2.18.2
2.18.6
1
gdrocha/togglr-backend:1.0.0d5ae64e83d4c
jackson-core@2.15.3
2.18.6
1
geonode/geoserver:2.28.4-latest81b1d431b7e9
jackson-core@2.21.0
2.21.1
1
geoservercloud/geoserver-cloud-gwc:3.0.1.1b04ed89b5d2b
jackson-core@2.21.0
2.21.1
1
geoservercloud/geoserver-cloud-rest:3.0.1.1318254b52f96
jackson-core@2.21.0
2.21.1
1
geoservercloud/geoserver-cloud-wcs:3.0.1.14f077124f591
jackson-core@2.21.0
2.21.1
1
geoservercloud/geoserver-cloud-webui:3.0.1.14f91e3048ac8
jackson-core@2.21.0
2.21.1
1
geoservercloud/geoserver-cloud-wfs:3.0.1.1299f0d6232d1
jackson-core@2.21.0
2.21.1
1
geoservercloud/geoserver-cloud-wms:3.0.1.15164f687ce4d
jackson-core@2.21.0
2.21.1
1
glasskube/operator:0.12.2be5133100d63
jackson-core@2.15.2
2.18.6
1
golenski/fibonacci-msg-relay:1.0.0c863dcb0c513
jackson-core@2.17.2
2.18.6
1
golenski/fibonacci-task-manager:2.0.03a2b36df247b
jackson-core@2.17.2
2.18.6
1
golenski/fibonacci-worker:2.0.0954caf4aaf6a
jackson-core@2.17.2
2.18.6
1
gotson/komga:1.22.0ba892ab3e082
jackson-core@2.18.1
2.18.6
1
graviteeio/ae-engine:3.0.24140932887e0
jackson-core@2.18.3
2.18.6
1
graylog/graylog:6.1.1019de1aff48c2
jackson-core@2.17.2
2.18.6
1
graylog/graylog-enterprise:7.1.88a1f641cd7aa
jackson-core@2.19.2
2.21.1
1
gridgain/cloud-connector:2025.5.15ab838d7d3cb
jackson-core@2.19.4
2.21.1
1
gridgain/community:8.9.11d32d182a0e6a
jackson-core@2.16.0
2.18.6
1
gridgain/gridgain9:9.1.1895018390077b
jackson-core@2.19.2
2.21.1
1
guacamole/guacamole:1.5.50f62f6d17ab3
jackson-core@2.17.0
2.18.6
1
hazelcast/hazelcast:5.3.18fe26efde8e1
jackson-core@2.15.2
2.18.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.