CVE-2026-54516
MediumAdvisory
Published 23 Jun 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.004
- 38th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 103
- of 17,781 indexed, latest versions
- Container images
- 98
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
Carried by container images the latest versions of 103 of 17,781 indexed charts deploy, on 98 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jackson-databindmaven | 2.21.0, 2.21.1, 2.21.2, 2.21.3+5 more | 2.21.4, 3.1.4 | 98 |
- OSV records
- GHSA-9fxm-vc8v-hj55
Charts affected
103 by stars
Container images carrying it
98 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| graylog/ | 598bd41fefd5 | jackson-databind | 2.21.4 | 1 |
| graylog/ | 8a1f641cd7aa | jackson-databind | 2.21.4 | 1 |
| gridgain/ | 95018390077b | jackson-databind | 2.21.4 | 1 |
| hazelcast/ | f086bf0ecb23 | jackson-databind | 2.21.4 | 1 |
| itzg/ | 1c59f9631f3b | jackson-databind | 3.1.4 | 1 |
| itzg/ | 4e29d14082d9 | jackson-databind | 3.1.4 | 1 |
| itzg/ | 8672e335dbef | jackson-databind | 3.1.4 | 1 |
| library/ | ae605bfcda05 | jackson-databind | 2.21.4 | 1 |
| library/ | 2caf944aa4a5 | jackson-databind | 2.21.4 | 1 |
| library/ | 6c162e2432f8 | jackson-databind | 2.21.4 | 1 |
| linuxserver/ | b6ce6968ee45 | jackson-databind | 2.21.4 | 1 |
| opennms/ | 88869082a14f | jackson-databind | 2.21.4 | 1 |
| openzipkin/ | a69e1057df36 | jackson-databind | 2.21.4 | 1 |
| payara/ | fb44b8ce1cb2 | jackson-databind | 2.21.4 | 1 |
| payara/ | 31f1253f0cf8 | jackson-databind | 2.21.4 | 1 |
| reportportal/ | bf193091525a | jackson-databind | 2.21.4 | 1 |
| scmmanager/ | bfb766050f34 | jackson-databind | 2.21.4 | 1 |
| siakhooi/ | f1f4b5b1b870 | jackson-databind | 3.1.4 | 1 |
| softwaremill/ | 845b5e8f8056 | jackson-databind | 3.1.4 | 1 |
| tchiotludo/ | c2824dc2ae44 | jackson-databind | 3.1.4 | 1 |
| tinymediamanager/ | 2b34dc85099e | jackson-databind | 2.21.4 | 1 |
| trinodb/ | 1565e8cac299 | jackson-databind | 2.21.4 | 1 |
| trinodb/ | 5b5e0a97f599 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | acb8dbce38fd | jackson-databind | 3.1.4 | 1 |
| ghcr.io/ | 8f4345c77dda | jackson-databind | 3.1.4 | 1 |
| ghcr.io/ | cf85570b1324 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 3be878690629 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | f1629ac5f9ec | jackson-databind | 3.1.4 | 1 |
| ghcr.io/ | 415323ef112b | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 05002092c621 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 6fe372e4e481 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | c4c52955814f | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | fd93e0d125b3 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | c1a267d9ed6d | jackson-databind | 3.1.4 | 1 |
| ghcr.io/ | a1b05567dbf6 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 708446bc6783 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | afe3bd73d7cf | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 0601750a3ca4 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 1cdfd1bcf476 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | e6c593fe75eb | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 9ad450220ab9 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 3b3670fce70b | jackson-databind | 3.1.4 | 1 |
| ghcr.io/ | 0bc598b2ac9a | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 447726cec07b | jackson-databind | 2.21.4 | 1 |
| quay.io/ | 0aae0de7fca8 | jackson-databind | 2.21.4 | 1 |
| quay.io/ | 9b0330756022 | jackson-databind | 2.21.4 | 1 |
| quay.io/ | 1a592ee6651a | jackson-databind | 2.21.4 | 1 |
| quay.io/ | 1a6eff92827a | jackson-databind | 2.21.4 | 1 |