StackRadar

CVE-2026-19032

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,012
of 17,957 indexed, latest versions
Container images
1,014
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Carried by container images the latest versions of 1,012 of 17,957 indexed charts deploy, on 1,014 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.8.1, 2.8.4, 2.8.6, 2.8.7+105 more2.18.10, 2.21.6, 2.22.2, 3.1.6+1 more1,014
OSV records
GHSA-wjgm-6hv5-3cvf
Trending
Rank 2 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

1,012 by stars
ChartLatestAffected imagesRadar Score
test-helm-charthelm-testVerified publisher0.1.01 of 1See more

test-helm-chart helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
prom/cloudwatch-exporter:cloudwatch_exporter-0.8.0fc4b9b9f5e15
jackson-databind@2.9.10.1
2.18.10

Open the chart page →

2,827
heronheron0.20.5-incubating1 of 2See more

heron heron 0.20.5-incubating

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/bookkeeper:4.14.5a7d9970c148f
jackson-databind@2.11.0
2.18.10

Open the chart page →

1,530
hivemq-edgehivemqOfficialVerified publisher0.1.361 of 1See more

hivemq-edge hivemq 0.1.36

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
hivemq/hivemq-edge:2026.14d8250a233cea
jackson-databind@2.19.2
2.21.6

Open the chart page →

1,441
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/tika:3.3.1.090b7fa1dc018
jackson-databind@2.21.3
2.21.6

Open the chart page →

29,775
eoloplanthttpd-eoloplant0.1.03 of 7See more

eoloplant httpd-eoloplant 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
jackson-databind@2.13.0
2.18.10
codeurjc/server:v1.0310bea5b1ee7
jackson-databind@2.13.4.2
2.18.10
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-databind@2.14.1
2.18.10

Open the chart page →

33,644
sys-info-web-env-view-serverhuajuan-helm-charts0.1.11 of 2See more

sys-info-web-env-view-server huajuan-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
huajuan6848/env-view-server:0.0.1-SNAPSHOTa303f3d9f6e0
jackson-databind@2.15.2
2.18.10

Open the chart page →

2,024
nexus3huangchengwu-helm-chart0.1.01 of 1See more

nexus3 huangchengwu-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
sonatype/nexus3:3.53.04bd975493104
jackson-databind@2.14.1
2.18.10

Open the chart page →

4,652
prometheushuangchengwu-helm-chart0.1.02 of 3See more

prometheus huangchengwu-helm-chart 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:9.2.0133d35d2c263
jackson-databind@2.13.2.2
2.18.10
apache/skywalking-ui:9.2.0295f1dc87d98
jackson-databind@2.13.2.2
2.18.10

Open the chart page →

17,067
skywalking-v1huangchengwu-helm-chart0.1.02 of 4See more

skywalking-v1 huangchengwu-helm-chart 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.9.1b4ec8c18d079
jackson-databind@2.12.2
2.18.10
apache/skywalking-ui:8.9.180530f0308a5
jackson-databind@2.12.2
2.18.10

Open the chart page →

21,109
mvfi4trustVerified publisher1.1.21 of 1See more

mvf i4trust 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
wistefan/mvf:lateste0887302b2d8
jackson-databind@2.12.1
2.18.10

Open the chart page →

7,541
vcwaltidi4trustVerified publisher0.0.191 of 1See more

vcwaltid i4trust 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
jackson-databind@2.14.2
2.18.10

Open the chart page →

8,323
ibm-business-automation-insights-devibm-charts3.2.02 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

2 of the 6 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ibmcom/bai-elasticsearch-dev:19.0.25441dba2fa00
jackson-databind@2.8.11.2
2.18.10
ibmcom/bai-flink-dev:19.0.2e31ff09e8aad
jackson-databind@2.9.8
2.18.10

Open the chart page →

39,863
ibm-kerify-devibm-charts1.0.01 of 1See more

ibm-kerify-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
jackson-databind@2.9.6
2.18.10

Open the chart page →

8,256
ibm-microclimateibm-charts0.1.03 of 8See more

ibm-microclimate ibm-charts 0.1.0

3 of the 8 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
jackson-databind@2.8.8
2.18.10
ibmcom/microclimate-theia:lateste17bdccc5030
jackson-databind@2.8.8
2.18.10
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

120,804
ibm-ws-dyn-agent-devibm-charts1.0.01 of 1See more

ibm-ws-dyn-agent-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ibmcom/ibm-workload-scheduler-agent-dynamic-dev:9.4.0.047e4dc1e27cdf
jackson-databind@2.9.4
2.18.10

Open the chart page →

19,554
eoloserverihuertas2021-vmartinp2021-helm0.1.03 of 7See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
codeurjc/server:v1.0310bea5b1ee7
jackson-databind@2.13.4.2
2.18.10
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-databind@2.14.1
2.18.10
huertaslopez/i.huertas.2021-v.martinp.2021-planner:2.0.0e2c18bd65472
jackson-databind@2.13.0
2.18.10

Open the chart page →

28,869
ikigaiikigai-chartVerified publisher0.0.92 of 58See more

ikigai ikigai-chart 0.0.9

2 of the 58 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
dremio/dremio-oss:24.1.080ed2e3b7c43
jackson-databind@2.14.2
2.18.10
library/zookeeper:3.8-temurin55d1e5b2e601
jackson-databind@2.15.2
2.18.10

Open the chart page →

117,870
freeipaimprowisedVerified publisher0.4.11 of 1See more

freeipa improwised 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
freeipa/freeipa-server:fedora-37-4.10.1c87d77342bf5
jackson-databind@2.11.4
2.18.10

Open the chart page →

1,269
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
jackson-databind@2.17.1
2.18.10

Open the chart page →

5,742
fpga-operatorinaccelVerified publisher2.8.21 of 7See more

fpga-operator inaccel 2.8.2

1 of the 7 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
inaccel/coral:2.18c53744ed70b
jackson-databind@2.13.5
2.18.10

Open the chart page →

5,826
neo4jinseefrlab3.2.01 of 1See more

neo4j inseefrlab 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/neo4j:4.4.43c9fea42bd5a
jackson-databind@2.12.4
2.18.10

Open the chart page →

2,211
openrefineinseefrlab3.5.01 of 1See more

openrefine inseefrlab 3.5.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
easypi/openrefine:3.7.0d2950a36a576
jackson-databind@2.13.4
2.18.10

Open the chart page →

1,802
pinotinseefrlab0.2.02 of 2See more

pinot inseefrlab 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apachepinot/pinot:latest-jdk110018bb04ced7
jackson-databind@2.10.0
2.18.10
library/zookeeper:3.5.5b7a76ec06f68
jackson-databind@2.9.8
2.18.10

Open the chart page →

10,894
itm-mqtt-brokerintelVerified publisher1.0.01 of 1See more

itm-mqtt-broker intel 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
hivemq/hivemq4:dns-4.5.144d194450d48e
jackson-databind@2.13.0
2.18.10

Open the chart page →

2,761
appswitcher-serverit-at-mOfficialVerified publisher2.0.21 of 1See more

appswitcher-server it-at-m 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
jackson-databind@2.18.3
2.18.10

Open the chart page →

4,050
daveit-at-mOfficialVerified publisher0.2.188 of 9See more

dave it-at-m 0.2.18

8 of the 9 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
jackson-databind@2.15.0
2.18.10
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
jackson-databind@2.21.4
2.21.6
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
jackson-databind@2.21.4
2.21.6
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
jackson-databind@2.21.4
2.21.6
ghcr.io/it-at-m/dave-eai/dave-eai:10.0.0fd93e0d125b3
jackson-databind@2.21.2
2.21.6
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
jackson-databind@2.21.4
2.21.6
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai:10.0.06a3fe3136856
jackson-databind@2.21.4
2.21.6
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
jackson-databind@2.21.4
2.21.6

Open the chart page →

13,737
kf-app-eaiit-at-mOfficialVerified publisher0.1.71 of 1See more

kf-app-eai it-at-m 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
jackson-databind@2.19.2
2.21.6

Open the chart page →

2,129
refarch-gatewayit-at-mVerified publisher1.10.01 of 1See more

refarch-gateway it-at-m 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/refarch/refarch-gateway:1.10.0d74e6a31e2fe
jackson-databind@3.1.5
3.1.6

Open the chart page →

193
refarch-templatesit-at-mVerified publisher2.3.01 of 1See more

refarch-templates it-at-m 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/refarch/refarch-gateway:1.10.0d74e6a31e2fe
jackson-databind@3.1.5
3.1.6

Open the chart page →

193
zammad-ldap-syncit-at-mVerified publisher0.6.51 of 1See more

zammad-ldap-sync it-at-m 0.6.5

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
jackson-databind@2.18.2
2.18.10

Open the chart page →

1,476
thehiveittrident-oss0.1.02 of 6See more

thehive ittrident-oss 0.1.0

2 of the 6 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/cassandra:4.03a4876cc7f18
jackson-databind@2.19.2
2.21.6
thehiveproject/cortex:3.1.7f4bc64fb8844
jackson-databind@2.11.1
2.18.10

Open the chart page →

6,112
opencloudjacobcolvinVerified publisher0.2.32 of 13See more

opencloud jacobcolvin 0.2.3

2 of the 13 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
jackson-databind@2.17.0
2.18.10
quay.io/keycloak/keycloak:26.1.4044a457e0498
jackson-databind@2.17.2
2.18.10

Open the chart page →

46,735
jasperjasperVerified publisher1.0.2091 of 2See more

jasper jasper 1.0.209

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/cjmalloy/jasper:v1.3.282726a947bb65b
jackson-databind@3.1.5
3.1.6

Open the chart page →

10,049
jenkinsjenkins-automation-tool0.1.01 of 1See more

jenkins jenkins-automation-tool 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

2,766
jenkinsjenkins-automation-tool-by-helm0.1.01 of 1See more

jenkins jenkins-automation-tool-by-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

2,766
jenkinsjenkins-chartVerified publisher0.1.01 of 1See more

jenkins jenkins-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

2,766
jx-app-jenkinsjenkins-x0.0.151 of 2See more

jx-app-jenkins jenkins-x 0.0.15

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

2,766
nexusjenkins-x0.1.371 of 1See more

nexus jenkins-x 0.1.37

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
jackson-databind@2.11.1
2.18.10

Open the chart page →

13,089
discord-experiencebotjfwenischVerified publisher0.7.41 of 1See more

discord-experiencebot jfwenisch 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/discord-experiencebot:latestb52ff07f9f0c
jackson-databind@2.13.4
2.18.10

Open the chart page →

8,312
proxerajfwenischVerified publisher0.12.201 of 1See more

proxera jfwenisch 0.12.20

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/wenisch-tech/proxera:0.12.205ac0e9f6b42f
jackson-databind@2.21.4
2.21.6

Open the chart page →

243
steamcmd-managerjfwenischVerified publisher0.4.51 of 1See more

steamcmd-manager jfwenisch 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/steamcmd-manager:v0.4.5dab685e668d9
jackson-databind@2.18.1
2.18.10

Open the chart page →

7,268
webtoolsjfwenischVerified publisher0.1.41 of 1See more

webtools jfwenisch 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/webtools:v0.1.44569cae83c70
jackson-databind@2.18.1
2.18.10

Open the chart page →

7,250
spring-boot-chartjhidalgo3-githubVerified publisher4.0.01 of 1See more

spring-boot-chart jhidalgo3-github 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jhidalgo3/spring-echo-example:lateste08733191ea0
jackson-databind@2.11.4
2.18.10

Open the chart page →

1,755
xxl-job-adminjoelee2012Verified publisher1.1.01 of 2See more

xxl-job-admin joelee2012 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
xuxueli/xxl-job-admin:2.4.0640093c35fd6
jackson-databind@2.13.5
2.18.10

Open the chart page →

3,187
james-mailserverjondos2.1.21 of 1See more

james-mailserver jondos 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/james:distributed-3.7.2660c0fa12ec2
jackson-databind@2.13.2.2
2.18.10

Open the chart page →

8,205
shinsei-managerjtektVerified publisher0.2.01 of 8See more

shinsei-manager jtekt 0.2.0

1 of the 8 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/neo4j:5.20.052d3dec8d455
jackson-databind@2.17.0
2.18.10

Open the chart page →

67,864
k8sforjavak8sforjava0.1.01 of 1See more

k8sforjava k8sforjava 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
vincentgwzhang/k8sforjava:latesta9139f2cd98f
jackson-databind@2.18.2
2.18.10

Open the chart page →

1,548
dynamo-dbk8s-home-lab-repo0.0.31 of 1See more

dynamo-db k8s-home-lab-repo 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
amazon/dynamodb-local:1.20.01ed00881c937
jackson-databind@2.12.7
2.18.10

Open the chart page →

483
k8skeycloak-controllerk8skeycloak-controller0.1.21 of 1See more

k8skeycloak-controller k8skeycloak-controller 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/doodlescheduling/k8skeycloak-controller:v0.0.19befc51b1ad6
jackson-databind@2.12.5
2.18.10

Open the chart page →

4,131
unifik8sonlabVerified publisher0.3.71 of 1See more

unifi k8sonlab 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jacobalberty/unifi:v10.0.162896c0ab82d33
jackson-databind@2.17.3
2.18.10

Open the chart page →

7,864

Container images carrying it

1,014 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
jackson-databind@2.15.3
2.18.10
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
jackson-databind@2.21.4
2.21.6
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
jackson-databind@2.21.4
2.21.6
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
jackson-databind@2.17.2
2.18.10
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
jackson-databind@2.13.5
2.18.10
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
jackson-databind@2.12.3
2.18.10
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-databind@2.22.0
2.22.2
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-databind@2.19.2
2.21.6
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-databind@2.16.2
2.18.10
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-databind@2.13.4.1
2.18.10
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-databind@2.14.2
2.18.10
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-databind@2.17.2
2.18.10
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-databind@2.13.5
2.18.10
1
registry.gitlab.com/lenitech/docker/keycloak:26.7.4-0993dd8a5e1f8
jackson-databind@2.21.5
2.21.6
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.