StackRadar

CVE-2026-68494

High

Advisory

Published 21 Jul 2026In the index since 3 Oct 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.005
38th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
926
of 17,992 indexed, latest versions
Container images
913
deployed by those charts
Fix available
1 of 1
affected package

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Carried by container images the latest versions of 926 of 17,992 indexed charts deploy, on 913 images.

Affected packageAffected versionsFixed inImages
jackson-coremaven2.0.5, 2.2.3, 2.3.0, 2.3.3+92 more2.18.8, 2.21.4, 3.1.4913
OSV records
GHSA-r7wm-3cxj-wff9

Charts affected

926 by stars
ChartLatestAffected imagesRadar Score
seata-serverheidaodageshiwoVerified publisher1.0.01 of 1See more

seata-server heidaodageshiwo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
seataio/seata-server:1.5.1ee1ed55f4144
jackson-core@2.11.4
2.18.8

Open the chart page →

5,730
guacamolehelmforgeVerified publisher1.5.31 of 5See more

guacamole helmforge 1.5.3

1 of the 5 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
jackson-core@2.19.0
2.21.4

Open the chart page →

10,290
kafkahelmforgeVerified publisher1.4.01 of 1See more

kafka helmforge 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
apache/kafka:4.3.177e3df905404
jackson-core@2.21.2
2.21.4

Open the chart page →

712
holoinsightholoinsight0.2.52 of 6See more

holoinsight holoinsight 0.2.5

2 of the 6 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
holoinsight/server:latest88978988756b
jackson-core@2.13.2
2.18.8
library/elasticsearch:7.16.18d5fd89230d7
jackson-core@2.10.4
2.18.8

Open the chart page →

29,719
iceberg-resticeberg-rest-fixture0.0.11 of 2See more

iceberg-rest iceberg-rest-fixture 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
ahmetfurkandemir/iceberg-rest-fixture-postgresql:1.10.0142231a0b8b7
jackson-core@2.18.4.1
2.18.8

Open the chart page →

3,905
elasticinseefrlab2.2.01 of 2See more

elastic inseefrlab 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.35e6ac15bf6a5
jackson-core@2.10.4
2.18.8

Open the chart page →

18,204
traccarjeffrescVerified publisher0.2.01 of 2See more

traccar jeffresc 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
traccar/traccar:6.7-alpine621c8d6d46fd
jackson-core@2.18.2
2.18.8

Open the chart page →

1,779
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
jackson-core@2.16.1
2.18.8

Open the chart page →

3,180
jetic-operatorjetic-operatorVerified publisher2.0.21 of 1See more

jetic-operator jetic-operator 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
apache/camel-k:1.10.43bb13d14f64a
jackson-core@2.13.4
2.18.8

Open the chart page →

10,576
chronoreaperjfwenischVerified publisher1.1.101 of 1See more

chronoreaper jfwenisch 1.1.10

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
ghcr.io/wenisch-tech/chronoreaper:1.1.10447726cec07b
jackson-core@2.21.3
2.21.4

Open the chart page →

1,189
ipfix-generatorjfwenischVerified publisher0.3.16-feature-helm-package.01 of 1See more

ipfix-generator jfwenisch 0.3.16-feature-helm-package.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/ipfix-generator:latesta1b05567dbf6
jackson-core@2.21.2
2.21.4

Open the chart page →

830
jenkinsjkimVerified publisher5.5.141 of 2See more

jenkins jkim 5.5.14

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
jenkins/jenkins:2.462.2-jdk1795313257a8cd
jackson-core@2.17.1
2.18.8

Open the chart page →

8,276
jmeterjmeterVerified publisher1.2.51 of 1See more

jmeter jmeter 1.2.5

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
liukunup/jmeter:5.59c079617a81b
jackson-core@2.13.3
2.18.8

Open the chart page →

2,163
kafka-kraft-on-k8skafka-kraft-on-k8sVerified publisher1.1.03 of 3See more

kafka-kraft-on-k8s kafka-kraft-on-k8s 1.1.0

3 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
kafkakraft/kafka-connect:3.7.0062d697db7e5
jackson-core@2.16.0
2.18.8
kafkakraft/kafka-controller:3.7.0f261ad288fce
jackson-core@2.16.0
2.18.8
kafkakraft/kafkakraft:3.7.02e4b593b878b
jackson-core@2.16.0
2.18.8

Open the chart page →

15,653
kokukokuVerified publisher1.0.02 of 7See more

koku koku 1.0.0

2 of the 7 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
jackson-core@2.4.0
2.18.8
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
jackson-core@2.18.2
2.18.8

Open the chart page →

12,766
hertzbeatkubesphere-testVerified publisher1.4.11 of 4See more

hertzbeat kubesphere-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
apache/iotdb:0.13.3-nodeafa47bf1692a
jackson-core@2.10.5
2.18.8

Open the chart page →

8,413
linstorkvaps1.14.02 of 11See more

linstor kvaps 1.14.0

2 of the 11 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
ghcr.io/kvaps/linstor-controller:v1.14.000ce11c31087
jackson-core@2.11.4
2.18.8
ghcr.io/kvaps/linstor-satellite:v1.14.0a573fb9bc809
jackson-core@2.11.4
2.18.8

Open the chart page →

21,537
drillmagasin-drill0.9.01 of 3See more

drill magasin-drill 0.9.0

1 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
merlos/zookeeper:3.9.3a38fc7e09ed7
jackson-core@2.15.2
2.18.8

Open the chart page →

6,297
magentomagento3.2.31 of 12See more

magento magento 3.2.3

1 of the 12 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
magento/magento-cloud-docker-opensearch:2.5-1.4.059fb6f0f1461
jackson-core@2.14.1
2.18.8

Open the chart page →

16,958
Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher1.0.11 of 6See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

1 of the 6 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
torrespro/mca-worker:2.0.06d3bd305a1ba
jackson-core@2.10.0
2.18.8

Open the chart page →

22,280
metabasemetabase-helmVerified publisher2.7.11 of 1See more

metabase metabase-helm 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
metabase/metabase:v0.46.09ebdc664a6b2
jackson-core@2.14.0
2.18.8

Open the chart page →

2,322
hadoopmiuler1.2.21 of 1See more

hadoop miuler 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
danisla/hadoop:2.9.0255ba2dd739b
jackson-core@2.7.8
2.18.8

Open the chart page →

6,622
clowder2ncsaVerified publisher1.9.72 of 12See more

clowder2 ncsa 1.9.7

2 of the 12 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.215d4647fd491
jackson-core@2.15.0
2.18.8
bitnamilegacy/keycloak:20.0.5cb04e49e6eb1
jackson-core@2.13.4
2.18.8

Open the chart page →

44,665
glowrootnovum-rgi-charts1.0.101 of 2See more

glowroot novum-rgi-charts 1.0.10

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
novumrgi/glowroot-central:0.14.0-beta.38c54790675b1
jackson-core@2.13.0
2.18.8

Open the chart page →

3,054
openccuopenccuVerified publisher3.89.111 of 1See more

openccu openccu 3.89.11

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.11.202609193cfcb30e1921
jackson-core@2.18.2
2.18.8

Open the chart page →

1,709
data-prepperopensearch-project-helm-chartsVerified publisher0.3.11 of 1See more

data-prepper opensearch-project-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
opensearchproject/data-prepper:2.8.057c25fa01d3c
jackson-core@2.17.0
2.18.8

Open the chart page →

1,932
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.21 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.2

1 of the 34 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-kafka4402ba7fd544
jackson-core@2.21.2
2.21.4

Open the chart page →

24,329
opikopikOfficialVerified publisher2.2.881 of 13See more

opik opik 2.2.88

1 of the 13 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
library/zookeeper:3.9.4dfa9ba46d14b
jackson-core@2.15.2
2.18.8

Open the chart page →

15,227
todo-apipavanelthepu0.1.01 of 2See more

todo-api pavanelthepu 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
pavanelthepu/todo-api:1.0.2f47658e3b24c
jackson-core@2.12.3
2.18.8

Open the chart page →

2,620
spring-boot-api-apppiominVerified publisher0.3.111 of 1See more

spring-boot-api-app piomin 0.3.11

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
piomin/sample-spring-kotlin-microservice:1.1871f784dd6bc
jackson-core@2.13.4
2.18.8

Open the chart page →

7,952
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.0332c6d416808
jackson-core@2.10.4
2.18.8
treskon/portrait:DEV-latest88e813f22347
jackson-core@2.17.3
2.18.8

Open the chart page →

35,784
nifi-registryprofyu1.14.0-r0011 of 1See more

nifi-registry profyu 1.14.0-r001

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
apache/nifi-registry:1.14.0090b7f87ec7f
jackson-core@2.12.3
2.18.8

Open the chart page →

5,309
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
library/neo4j:2026.02.25ab4ab0358cf
jackson-core@2.20.1
2.21.4

Open the chart page →

9,778
kafka-managerradar-baseVerified publisher2.3.11 of 1See more

kafka-manager radar-base 2.3.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
radarbase/kafka-manager:1.3.3.181d2af7dd5a4e
jackson-core@2.9.4
2.18.8

Open the chart page →

4,037
shinyproxyremche0.6.61 of 2See more

shinyproxy remche 0.6.6

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
remche/shinyproxy:2.6.18bcda8a04d3b
jackson-core@2.12.6
2.18.8

Open the chart page →

4,458
reportportalreportportal-ioOfficialVerified publisher26.8.123 of 15See more

reportportal reportportal-io 26.8.12

3 of the 15 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
reportportal/service-api:5.15.4bf193091525a
jackson-core@2.21.2
2.21.4
reportportal/service-authorization:5.15.16a954407b417
jackson-core@2.21.2
2.21.4
reportportal/service-jobs:5.15.299d27d58d6b4
jackson-core@2.21.2
2.21.4

Open the chart page →

15,192
reservation-appreservation-app1.0.91 of 4See more

reservation-app reservation-app 1.0.9

1 of the 4 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
zbalogh/reservation-api-server:1.0.97c247e399a1f
jackson-core@2.13.4
2.18.8

Open the chart page →

8,502
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
resurfaceio/resurface:3.7.84d5cda2f64109
jackson-core@2.18.2
2.18.8

Open the chart page →

8,582
service-names-port-numbersrm3lVerified publisher0.26.11 of 1See more

service-names-port-numbers rm3l 0.26.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
rm3l/service-names-port-numbers:0.12.162d1cc4223e5
jackson-core@2.13.0
2.18.8

Open the chart page →

10,500
elasticsearchromanow-helm-chartsVerified publisher1.7.11 of 2See more

elasticsearch romanow-helm-charts 1.7.1

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.8fdc73b3249c1
jackson-core@2.10.4
2.18.8

Open the chart page →

6,450
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
jackson-core@2.13.2
2.18.8

Open the chart page →

8,476
routrroutr0.0.101 of 2See more

routr routr 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
fonoster/routr:1.0.0-rc52ca65af17cbc
jackson-core@2.10.0
2.18.8

Open the chart page →

5,496
seldon-coreseldon0.2.72 of 3See more

seldon-core seldon 0.2.7

2 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
seldonio/apife:0.2.7ba81b17f00eb
jackson-core@2.8.11
2.18.8
seldonio/cluster-manager:0.2.729e362bb1ba2
jackson-core@2.8.11
2.18.8

Open the chart page →

13,907
sentinel-dashboardsentinel-dashboardVerified publisher0.1.01 of 1See more

sentinel-dashboard sentinel-dashboard 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
royalwang/sentinel-dashboard:1.8.4df99e2499f91
jackson-core@2.12.2
2.18.8

Open the chart page →

4,973
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.6.683dbca3efd2a
jackson-core@2.14.2
2.18.8

Open the chart page →

20,121
querysiakhooiVerified publisher1.0.01 of 1See more

query siakhooi 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
siakhooi/query:1.0.0f1f4b5b1b870
jackson-core@2.21.2
2.21.4

Open the chart page →

1,979
clickhousesignoz24.1.181 of 3See more

clickhouse signoz 24.1.18

1 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
signoz/zookeeper:3.7.1fcc4a3288154
jackson-core@2.13.2
2.18.8

Open the chart page →

6,366
signserver-cesignserverOfficialVerified publisher2.4.41 of 1See more

signserver-ce signserver 2.4.4

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
keyfactor/signserver-ce:7.7.1f8d64caeaea9
jackson-core@2.17.0
2.18.8

Open the chart page →

1,248
ocean-metric-exporterspot1.1.11 of 1See more

ocean-metric-exporter spot 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
jackson-core@2.19.2
2.21.4

Open the chart page →

1,630
stardogstardog3.1.01 of 3See more

stardog stardog 3.1.0

1 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
stardog/stardog:latest2714e5c4b3c1
jackson-core@2.18.3
2.18.8

Open the chart page →

582

Container images carrying it

913 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
jackson-core@2.14.1
2.18.8
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
jackson-core@2.15.3
2.18.8
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
jackson-core@2.15.3
2.18.8
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
jackson-core@2.15.3
2.18.8
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
jackson-core@2.17.2
2.18.8
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
jackson-core@2.13.5
2.18.8
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
jackson-core@2.12.3
2.18.8
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-core@2.19.2
2.21.4
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-core@2.16.2
2.18.8
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-core@2.13.4
2.18.8
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-core@2.14.2
2.18.8
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-core@2.17.2
2.18.8
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-core@2.18.0
2.18.8
1

syft 1.42.1 · advisories as of 4 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.