CVE-2026-54515
MediumAdvisory
Published 23 Jun 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.003
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 892
- of 17,787 indexed, latest versions
- Container images
- 895
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Carried by container images the latest versions of 892 of 17,787 indexed charts deploy, on 895 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jackson-databindmaven | 2.8.1, 2.8.4, 2.8.6, 2.8.7+95 more | 2.18.9, 2.21.5, 2.22.1, 3.1.4 | 895 |
- OSV records
- GHSA-5jmj-h7xm-6q6v
Charts affected
892 by stars
Container images carrying it
895 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| vitalii1992/ | aabe6ac39356 | jackson-databind | 2.18.9 | 1 |
| vitalii1992/ | 07c4a8833ce4 | jackson-databind | 2.18.9 | 1 |
| vitalii1992/ | 44d2d6e00ab3 | jackson-databind | 2.18.9 | 1 |
| vlebediantsev/ | e7f20450d2ae | jackson-databind | 2.18.9 | 1 |
| vlebediantsev/ | 10393a89b4a8 | jackson-databind | 2.18.9 | 1 |
| vlebediantsev/ | df8bf38c535b | jackson-databind | 2.18.9 | 1 |
| vlebediantsev/ | 427af418b75e | jackson-databind | 2.18.9 | 1 |
| vlebediantsev/ | 9319437f3c8f | jackson-databind | 2.18.9 | 1 |
| voltha/ | e038acb950d3 | jackson-databind | 2.18.9 | 1 |
| vrijbrp/ | 5c770c2ae48c | jackson-databind | 2.18.9 | 1 |
| wavefronthq/ | d1064d28f6eb | jackson-databind | 2.18.9 | 1 |
| wazuh/ | 9c344d2b1757 | jackson-databind | 2.18.9 | 1 |
| wazuh/ | a7a2076b167e | jackson-databind | 2.18.9 | 1 |
| wazuh/ | b149b30da686 | jackson-databind | 2.18.9 | 1 |
| wistefan/ | e0887302b2d8 | jackson-databind | 2.18.9 | 1 |
| woojoong/ | ec230db19652 | jackson-databind | 2.18.9 | 1 |
| xeotek/ | 39a3b37a17c5 | jackson-databind | 2.18.9 | 1 |
| xeotek/ | 4c6b04d9ce55 | jackson-databind | 2.18.9 | 1 |
| xuxueli/ | 640093c35fd6 | jackson-databind | 2.18.9 | 1 |
| yuzutech/ | 192b7b27c857 | jackson-databind | 2.18.9 | 1 |
| zahoriaut/ | 351f8a220ed7 | jackson-databind | 2.18.9 | 1 |
| zahoriaut/ | b2de13916f3e | jackson-databind | 2.18.9 | 1 |
| zammad/ | 8274d75a51fc | jackson-databind | 2.18.9 | 1 |
| zbalogh/ | 7c247e399a1f | jackson-databind | 2.18.9 | 1 |
| gcr.io/ | 0ee5f968d2ab | jackson-databind | 2.18.9 | 1 |
| gcr.io/ | ae57b62291aa | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | e9c2ce635b89 | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | 4a2824296412 | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | d3d3af34bc2c | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | 0eb3ad229c2c | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | d9d796a1b846 | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | acab5b4b3d32 | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | 503c00321502 | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | f3d0c7d35498 | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | aa45adaf59a7 | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | 30d1a445acc7 | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | e310642de2e2 | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | 90a34412c6b5 | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | acb8dbce38fd | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | c144bdd688d7 | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | ac62269785ac | jackson-databind | 2.18.9 | 1 |
| ghcr.io/ | 8f4345c77dda | jackson-databind | 3.1.4 | 1 |
| ghcr.io/ | cf85570b1324 | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | 3be878690629 | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | f1629ac5f9ec | jackson-databind | 3.1.4 | 1 |
| ghcr.io/ | 415323ef112b | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | 05002092c621 | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | 6fe372e4e481 | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | c4c52955814f | jackson-databind | 2.21.5 | 1 |
| ghcr.io/ | a7d0cc9e260a | jackson-databind | 2.21.5 | 1 |