CVE-2026-54515
MediumAdvisory
Published 23 Jun 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.003
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 892
- of 17,787 indexed, latest versions
- Container images
- 895
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Carried by container images the latest versions of 892 of 17,787 indexed charts deploy, on 895 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jackson-databindmaven | 2.8.1, 2.8.4, 2.8.6, 2.8.7+95 more | 2.18.9, 2.21.5, 2.22.1, 3.1.4 | 895 |
- OSV records
- GHSA-5jmj-h7xm-6q6v
Charts affected
892 by stars
Container images carrying it
895 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| geoservercloud/ | ca58b74529cd | jackson-databind | 2.18.9 | 1 |
| geoservercloud/ | de0b20bd2a43 | jackson-databind | 3.1.4 | 1 |
| geoservercloud/ | b04ed89b5d2b | jackson-databind | 2.21.5 | 1 |
| geoservercloud/ | 318254b52f96 | jackson-databind | 3.1.4 | 1 |
| geoservercloud/ | 5dc0c93a1710 | jackson-databind | 2.18.9 | 1 |
| geoservercloud/ | 47ae1bdb4bcc | jackson-databind | 2.18.9 | 1 |
| geoservercloud/ | 4f077124f591 | jackson-databind | 2.21.5 | 1 |
| geoservercloud/ | 28c3e5a8c5a3 | jackson-databind | 2.18.9 | 1 |
| geoservercloud/ | 4f91e3048ac8 | jackson-databind | 2.21.5 | 1 |
| geoservercloud/ | 299f0d6232d1 | jackson-databind | 3.1.4 | 1 |
| geoservercloud/ | 8c70ee06d5ab | jackson-databind | 2.18.9 | 1 |
| geoservercloud/ | 42775ba6a4da | jackson-databind | 2.18.9 | 1 |
| geoservercloud/ | 5164f687ce4d | jackson-databind | 2.21.5 | 1 |
| glarad/ | 7b02b9e7f1ef | jackson-databind | 2.21.5 | 1 |
| glasskube/ | be5133100d63 | jackson-databind | 2.18.9 | 1 |
| gluufederation/ | 1a1128b28b95 | jackson-databind | 2.18.9 | 1 |
| gocd/ | 2da45cb09d57 | jackson-databind | 2.18.9 | 1 |
| gocd/ | 720d1012b93f | jackson-databind | 2.22.1 | 1 |
| golenski/ | c863dcb0c513 | jackson-databind | 2.18.9 | 1 |
| golenski/ | 3a2b36df247b | jackson-databind | 2.18.9 | 1 |
| golenski/ | 954caf4aaf6a | jackson-databind | 2.18.9 | 1 |
| gotson/ | 9b15ea6bfc30 | jackson-databind | 2.18.9 | 1 |
| gotson/ | ba892ab3e082 | jackson-databind | 2.18.9 | 1 |
| gradiant/ | e3bf364fe713 | jackson-databind | 2.18.9 | 1 |
| gradiant/ | 45eceb1bc55c | jackson-databind | 2.18.9 | 1 |
| graviteeio/ | 4140932887e0 | jackson-databind | 2.18.9 | 1 |
| graviteeio/ | 07b7f6dc267a | jackson-databind | 2.21.5 | 1 |
| graviteeio/ | a8eb04ee0c70 | jackson-databind | 2.21.5 | 1 |
| graylog2/ | 8ff28c66e6c1 | jackson-databind | 2.18.9 | 1 |
| graylog/ | 19de1aff48c2 | jackson-databind | 2.18.9 | 1 |
| graylog/ | 598bd41fefd5 | jackson-databind | 2.21.5 | 1 |
| graylog/ | 8a1f641cd7aa | jackson-databind | 2.21.5 | 1 |
| gresearchdev/ | 91863a50afb7 | jackson-databind | 2.18.9 | 1 |
| gresearchdev/ | 8dad36a05ebf | jackson-databind | 2.18.9 | 1 |
| gridgain/ | 5ab838d7d3cb | jackson-databind | 2.21.5 | 1 |
| gridgain/ | d32d182a0e6a | jackson-databind | 2.18.9 | 1 |
| gridgain/ | 95018390077b | jackson-databind | 2.21.5 | 1 |
| guacamole/ | 0f62f6d17ab3 | jackson-databind | 2.18.9 | 1 |
| gurolakman/ | 9abb3882bcbd | jackson-databind | 2.18.9 | 1 |
| gurolakman/ | 6537e8ed8de8 | jackson-databind | 2.18.9 | 1 |
| gurolakman/ | ce23b20a8a17 | jackson-databind | 2.18.9 | 1 |
| gurolakman/ | b22e746edd5d | jackson-databind | 2.18.9 | 1 |
| gurolakman/ | bf18525c5ad9 | jackson-databind | 2.18.9 | 1 |
| gurolakman/ | 8739565c3ea2 | jackson-databind | 2.18.9 | 1 |
| hazelcast/ | 8fe26efde8e1 | jackson-databind | 2.18.9 | 1 |
| hazelcast/ | ca7d5589744f | jackson-databind | 2.18.9 | 1 |
| hazelcast/ | f086bf0ecb23 | jackson-databind | 2.21.5 | 1 |
| hazelcast/ | 20be7743a9c7 | jackson-databind | 2.22.1 | 1 |
| hazelcast/ | a825ecbe9fda | jackson-databind | 2.18.9 | 1 |
| hazelcast/ | df495e64ea65 | jackson-databind | 2.18.9 | 1 |