StackRadar

CVE-2026-19032

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,012
of 17,957 indexed, latest versions
Container images
1,014
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Carried by container images the latest versions of 1,012 of 17,957 indexed charts deploy, on 1,014 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.8.1, 2.8.4, 2.8.6, 2.8.7+105 more2.18.10, 2.21.6, 2.22.2, 3.1.6+1 more1,014
OSV records
GHSA-wjgm-6hv5-3cvf
Trending
Rank 2 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

1,012 by stars
ChartLatestAffected imagesRadar Score
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
jackson-databind@2.9.7
2.18.10

Open the chart page →

28,909
promcordgeek-cookbookVerified publisher5.4.21 of 1See more

promcord geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
biospheere/promcord:latest16d4fd269e66
jackson-databind@2.10.1
2.18.10

Open the chart page →

1,174
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
jackson-databind@2.16.1
2.18.10

Open the chart page →

9,690
kafkagengxiankun-charts0.2.01 of 1See more

kafka gengxiankun-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.10

Open the chart page →

4,647
zookeepergengxiankun-charts0.2.01 of 1See more

zookeeper gengxiankun-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/zookeeper:3.6.24c8a6d3b2338
jackson-databind@2.10.3
2.18.10

Open the chart page →

1,955
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.83 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

3 of the 5 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
jackson-databind@2.9.6
2.18.10
jingking/geonetwork-hnap:4.2.843e74ab234e1
jackson-databind@2.10.5
2.18.10
library/elasticsearch:7.17.1588c2ec10c7f2
jackson-databind@2.14.2
2.18.10

Open the chart page →

35,858
geysergeyserVerified publisher0.1.31 of 1See more

geyser geyser 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/joffreybvn/k8s-geyser:0.0.247f36880072e
jackson-databind@2.18.0
2.18.10

Open the chart page →

426
ldap-backupgluuVerified publisher1.6.111 of 1See more

ldap-backup gluu 1.6.11

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
gluufederation/opendj:4.3.0_011a1128b28b95
jackson-databind@2.11.1
2.18.10

Open the chart page →

3,174
jaegergpg-dev3.3.31 of 5See more

jaeger gpg-dev 3.3.3

1 of the 5 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
jackson-databind@2.13.2.2
2.18.10

Open the chart page →

19,898
opentelemetry-demogpg-dev0.33.84 of 27See more

opentelemetry-demo gpg-dev 0.33.8

4 of the 27 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
jackson-databind@2.17.2
2.18.10
ghcr.io/open-telemetry/demo:1.12.0-kafka071a788162e8
jackson-databind@2.16.0
2.18.10
ghcr.io/open-telemetry/demo:1.12.0-frauddetectionservice77cefdab4d5c
jackson-databind@2.17.1
2.18.10
ghcr.io/open-telemetry/demo:1.12.0-adservicea59e5eead495
jackson-databind@2.17.2
2.18.10

Open the chart page →

52,401
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
jackson-databind@2.9.6
2.18.10

Open the chart page →

16,107
opentsdbgradiant-bigdataVerified publisher0.1.72 of 6See more

opentsdb gradiant-bigdata 0.1.7

2 of the 6 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
jackson-databind@2.9.2
2.18.10
gradiant/opentsdb:2.4.0c33d53913869
jackson-databind@2.9.5
2.18.10

Open the chart page →

17,480
supertokensgraphql-hive1.0.01 of 1See more

supertokens graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
jackson-databind@2.10.0
2.18.10

Open the chart page →

2,723
gravitino-iceberg-rest-server-helmgravitino-iceberg-rest-server1.3.111 of 1See more

gravitino-iceberg-rest-server-helm gravitino-iceberg-rest-server 1.3.11

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/gravitino-iceberg-rest:1.3.080136ae753ee
jackson-databind@2.21.3
2.21.6

Open the chart page →

5,059
grayloggraylogVerified publisher1.0.21 of 4See more

graylog graylog 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
graylog/graylog:6.1.1019de1aff48c2
jackson-databind@2.17.2
2.18.10

Open the chart page →

5,381
siembolgresearch0.1.62 of 4See more

siembol gresearch 0.1.6

2 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
gresearchdev/siembol-config-editor-rest:latest91863a50afb7
jackson-databind@2.13.4.2
2.18.10
gresearchdev/siembol-storm-topology-manager:latest8dad36a05ebf
jackson-databind@2.13.4.2
2.18.10

Open the chart page →

14,445
cc-spring-appgridgainVerified publisher1.0.61 of 1See more

cc-spring-app gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
gridgain/cloud-connector:2025.5.15ab838d7d3cb
jackson-databind@2.19.4
2.21.6

Open the chart page →

1,841
gridgain9gridgainVerified publisher1.1.101 of 2See more

gridgain9 gridgain 1.1.10

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
gridgain/gridgain9:9.1.1895018390077b
jackson-databind@2.19.2
2.21.6

Open the chart page →

3,713
guacamoleguacamole1.0.01 of 4See more

guacamole guacamole 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
jackson-databind@2.19.0
2.21.6

Open the chart page →

4,361
mautrix-signalhalkeye0.3.01 of 2See more

mautrix-signal halkeye 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
signald/signald:0.23.2edbff058278c
jackson-databind@2.14.1
2.18.10

Open the chart page →

1,552
ubooquityhalkeye0.1.11 of 1See more

ubooquity halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
linuxserver/ubooquity:2.1.2-ls369932d6759112
jackson-databind@2.8.4
2.18.10

Open the chart page →

4,295
hazelcast-jethazelcastVerified publisher1.17.11 of 1See more

hazelcast-jet hazelcast 1.17.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
hazelcast/hazelcast-jet:4.5.3a825ecbe9fda
jackson-databind@2.11.4
2.18.10

Open the chart page →

6,182
hbasehbase0.1.72 of 4See more

hbase hbase 0.1.7

2 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
jackson-databind@2.13.3
2.18.10
ghcr.io/fleeksoft/hbase/hdfs:3.3.3.2ac62269785ac
jackson-databind@2.13.2.2
2.18.10

Open the chart page →

10,695
nacosheidaodageshiwoVerified publisher0.1.51 of 1See more

nacos heidaodageshiwo 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
nacos/nacos-server:v2.1.0dcf04549c6d7
jackson-databind@2.12.2
2.18.10

Open the chart page →

4,050
hello-world-apihello-world-api0.0.51 of 1See more

hello-world-api hello-world-api 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
fabioformosa/hello-world-api:latest063873af085c
jackson-databind@2.18.3
2.18.10

Open the chart page →

1,468
helm-airportshelm-airports0.1.04 of 7See more

helm-airports helm-airports 0.1.0

4 of the 7 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
dina1993/airports-api:latestac731244aed1
jackson-databind@2.14.2
2.18.10
dina1993/airports-consumer:latest669d146a5e63
jackson-databind@2.14.2
2.18.10
dina1993/airports-producer:latest3d6b0dac1cb4
jackson-databind@2.14.2
2.18.10
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.10

Open the chart page →

12,928
airports-kafkahelm-airports-dan0.1.01 of 2See more

airports-kafka helm-airports-dan 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.10

Open the chart page →

4,647
helm-airportshelm-airports-dan0.1.01 of 7See more

helm-airports helm-airports-dan 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.10

Open the chart page →

5,678
airports-kafkahelm-airports-kafka0.1.01 of 2See more

airports-kafka helm-airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.10

Open the chart page →

4,647
jenkinshelm-chart-for-jenkinsVerified publisher1.0.01 of 1See more

jenkins helm-chart-for-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

2,766
pageshelm-chart-repos-camden1.0.01 of 3See more

pages helm-chart-repos-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-databind@2.11.0
2.18.10

Open the chart page →

20,652
springboothelmcharts1.0.01 of 1See more

springboot helmcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
kimb88/hello-world-spring-boot:latest0639155241cb
jackson-databind@2.9.6
2.18.10

Open the chart page →

6,448
metabasehelm-charts-nr0.14.41 of 1See more

metabase helm-charts-nr 0.14.4

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
metabase/metabase:v0.45.21fb334ce4820
jackson-databind@2.13.4.2
2.18.10

Open the chart page →

2,617
wiremockhelm-charts-nr1.4.61 of 2See more

wiremock helm-charts-nr 1.4.6

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
rodolpheche/wiremock:2.26.03be08a386092
jackson-databind@2.10.0
2.18.10

Open the chart page →

2,154
cruise-controlhelm-cruise-controlVerified publisher2.1.21 of 2See more

cruise-control helm-cruise-control 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/kafka-cruise-control:jdk17-cc2.5.146-iam2.3.90885af088157
jackson-databind@2.22.1
2.22.2

Open the chart page →

1,547
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
dannielkil/book-backend:lateste3b479a55a69
jackson-databind@2.13.3
2.18.10

Open the chart page →

9,480
jasperreportshelm-dojo8.0.0-v1.31 of 2See more

jasperreports helm-dojo 8.0.0-v1.3

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
palopalepalo/jasperreports:8-v1.356b99b194d20
jackson-databind@2.13.2.2
2.18.10

Open the chart page →

6,611
alfiohelmforgeVerified publisher1.2.121 of 3See more

alfio helmforge 1.2.12

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
alfio/alf.io:2.0-M5-26060c836a081446
jackson-databind@2.21.2
2.21.6

Open the chart page →

1,918
booklorehelmforgeVerified publisher2.0.21 of 3See more

booklore helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
jackson-databind@2.21.4
2.21.6

Open the chart page →

2,006
ckanhelmforgeVerified publisher1.3.91 of 6See more

ckan helmforge 1.3.9

1 of the 6 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
jackson-databind@2.12.7.1
2.18.10

Open the chart page →

10,031
druidhelmforgeVerified publisher1.3.62 of 4See more

druid helmforge 1.3.6

2 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
jackson-databind@2.19.2
2.21.6
library/zookeeper:3.9.57d0f24ebb67b
jackson-databind@2.15.2
2.18.10

Open the chart page →

8,757
elasticsearchhelmforgeVerified publisher1.1.81 of 2See more

elasticsearch helmforge 1.1.8

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.3a4e2b3d21ad0
jackson-databind@2.21.5
2.21.6

Open the chart page →

364
jenkinshelmforgeVerified publisher1.0.91 of 1See more

jenkins helmforge 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:2.568.3-lts-jdk21c1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

2,766
kibanahelmforgeVerified publisher1.1.81 of 3See more

kibana helmforge 1.1.8

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.19656a9ca03f8
jackson-databind@2.18.8
2.18.10

Open the chart page →

484
komgahelmforgeVerified publisher1.4.161 of 1See more

komga helmforge 1.4.16

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
gotson/komga:1.27.19cf102f5fb78
jackson-databind@2.21.4
2.21.6

Open the chart page →

35,590
minecrafthelmforgeVerified publisher1.5.51 of 1See more

minecraft helmforge 1.5.5

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
itzg/minecraft-server:2026.9.2de5d1b1a83eb
jackson-databind@3.1.3
3.1.6

Open the chart page →

4,280
zookeeperhelmforgeVerified publisher1.0.21 of 1See more

zookeeper helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/zookeeper:3.9.57d0f24ebb67b
jackson-databind@2.15.2
2.18.10

Open the chart page →

3,203
openbashelm-openbasVerified publisher1.8.142 of 7See more

openbas helm-openbas 1.8.14

2 of the 7 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
openbas/platform:2.0.5d986d80b0a75
jackson-databind@2.17.3
2.18.10
opensearchproject/opensearch:3.3.2798cf28e226a
jackson-databind@2.17.1
2.18.10

Open the chart page →

26,784
pageshelm-repo1.0.01 of 3See more

pages helm-repo 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-databind@2.11.0
2.18.10

Open the chart page →

20,652
todo-apihelm-repo-sharif0.1.01 of 2See more

todo-api helm-repo-sharif 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
pavanelthepu/todo-api:1.0.2f47658e3b24c
jackson-databind@2.12.3
2.18.10

Open the chart page →

2,580

Container images carrying it

1,014 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
jackson-databind@2.15.3
2.18.10
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
jackson-databind@2.21.4
2.21.6
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
jackson-databind@2.21.4
2.21.6
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
jackson-databind@2.17.2
2.18.10
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
jackson-databind@2.13.5
2.18.10
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
jackson-databind@2.12.3
2.18.10
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-databind@2.22.0
2.22.2
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-databind@2.19.2
2.21.6
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-databind@2.16.2
2.18.10
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-databind@2.13.4.1
2.18.10
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-databind@2.14.2
2.18.10
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-databind@2.17.2
2.18.10
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-databind@2.13.5
2.18.10
1
registry.gitlab.com/lenitech/docker/keycloak:26.7.4-0993dd8a5e1f8
jackson-databind@2.21.5
2.21.6
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.