StackRadar

CVE-2026-68494

High

Advisory

Published 21 Jul 2026In the index since 3 Oct 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.005
38th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
932
of 18,026 indexed, latest versions
Container images
921
deployed by those charts
Fix available
1 of 1
affected package

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Carried by container images the latest versions of 932 of 18,026 indexed charts deploy, on 921 images.

Affected packageAffected versionsFixed inImages
jackson-coremaven2.0.5, 2.2.3, 2.3.0, 2.3.3+91 more2.18.8, 2.21.4, 3.1.4921
OSV records
GHSA-r7wm-3cxj-wff9

Charts affected

932 by stars
ChartLatestAffected imagesRadar Score
querysiakhooiVerified publisher1.0.01 of 1See more

query siakhooi 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
siakhooi/query:1.0.0f1f4b5b1b870
jackson-core@2.21.2
2.21.4

Open the chart page →

1,997
clickhousesignoz24.1.181 of 3See more

clickhouse signoz 24.1.18

1 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
signoz/zookeeper:3.7.1fcc4a3288154
jackson-core@2.13.2
2.18.8

Open the chart page →

6,370
signserver-cesignserverOfficialVerified publisher2.4.41 of 1See more

signserver-ce signserver 2.4.4

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
keyfactor/signserver-ce:7.7.1f8d64caeaea9
jackson-core@2.17.0
2.18.8

Open the chart page →

1,248
ocean-metric-exporterspot1.1.11 of 1See more

ocean-metric-exporter spot 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
jackson-core@2.19.2
2.21.4

Open the chart page →

1,648
stardogstardog3.1.01 of 3See more

stardog stardog 3.1.0

1 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
stardog/stardog:latest2714e5c4b3c1
jackson-core@2.18.3
2.18.8

Open the chart page →

582
starwhalestarwhaleVerified publisher0.6.151 of 4See more

starwhale starwhale 0.6.15

1 of the 4 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
ghcr.io/star-whale/server:0.6.158368359c8dd0
jackson-core@2.4.0
2.18.8

Open the chart page →

14,210
ckanstatcan0.0.352 of 8See more

ckan statcan 0.0.35

2 of the 8 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
jackson-core@2.12.3
2.18.8
library/zookeeper:3.5.5b7a76ec06f68
jackson-core@2.9.8
2.18.8

Open the chart page →

105,042
streamvisorstreamvisorVerified publisher4.1.61 of 1See more

streamvisor streamvisor 4.1.6

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
jackson-core@2.21.2
2.21.4

Open the chart page →

3,244
strimzi-drain-cleanerstrimzi1.6.11 of 1See more

strimzi-drain-cleaner strimzi 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
quay.io/strimzi/drain-cleaner:1.6.15fb28e9f30d0
jackson-core@2.21.2
2.21.4

Open the chart page →

721
strimzi-drain-cleanerstrimzi-drain-cleaner1.6.11 of 1See more

strimzi-drain-cleaner strimzi-drain-cleaner 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
quay.io/strimzi/drain-cleaner:1.6.15fb28e9f30d0
jackson-core@2.21.2
2.21.4

Open the chart page →

721
graylogt3n1.0.01 of 3See more

graylog t3n 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
graylog2/server:2.4.3-38ff28c66e6c1
jackson-core@2.8.9
2.18.8

Open the chart page →

8,931
snowplowt3n0.0.11 of 1See more

snowplow t3n 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
snowplow/scala-stream-collector-pubsub:2.2.041d318841516
jackson-core@2.11.1
2.18.8

Open the chart page →

2,730
jenkinstestchart0.1.91 of 2See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
jackson-core@2.15.2
2.18.8

Open the chart page →

10,039
jenkinstest-jenkins9.1.01 of 2See more

jenkins test-jenkins 9.1.0

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
jackson-core@2.15.2
2.18.8

Open the chart page →

10,039
tocktock0.6.36 of 9See more

tock tock 0.6.3

6 of the 9 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
tock/bot_admin:25.10.7df3e38c77a38
jackson-core@2.20.0
2.21.4
tock/bot_api:25.10.7dd5d5c70e333
jackson-core@2.20.0
2.21.4
tock/build_worker:25.10.7080cb6b08d5b
jackson-core@2.20.0
2.21.4
tock/duckling:25.10.7ac1f3f1a1e9c
jackson-core@2.20.0
2.21.4
tock/kotlin_compiler:25.10.7c9c0fb40089a
jackson-core@2.20.0
2.21.4
tock/nlp_api:25.10.7c04ffe67b977
jackson-core@2.20.0
2.21.4

Open the chart page →

15,952
wavefront-adapter-for-istiowavefront0.1.41 of 2See more

wavefront-adapter-for-istio wavefront 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
wavefronthq/proxy:9.2d1064d28f6eb
jackson-core@2.11.0
2.18.8

Open the chart page →

16,636
spark-operatorwikimedia2.2.71 of 1See more

spark-operator wikimedia 2.2.7

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
jackson-core@2.13.4
2.18.8

Open the chart page →

57,592
workflows-aggregatorworkflows-aggregatorVerified publisher0.16.121 of 1See more

workflows-aggregator workflows-aggregator 0.16.12

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/workflows-aggregator:0.16.12ce790a4023b6
jackson-core@2.18.0
2.18.8

Open the chart page →

876
accountaccount-serviceVerified publisher0.4.21 of 1See more

account account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
vitalii1992/account-service:latest0e694d94551d
jackson-core@2.15.0
2.18.8

Open the chart page →

2,252
analyticsaccount-serviceVerified publisher0.4.21 of 1See more

analytics account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
vitalii1992/analytics-service:latest8e798836ecea
jackson-core@2.15.0
2.18.8

Open the chart page →

2,414
gatewayaccount-serviceVerified publisher0.4.21 of 1See more

gateway account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
vitalii1992/api-gateway-service:latestaabe6ac39356
jackson-core@2.15.0
2.18.8

Open the chart page →

2,968
keycloakaccount-serviceVerified publisher18.4.51 of 2See more

keycloak account-service 18.4.5

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:17.0.1-legacy68f9f38c8f30
jackson-core@2.11.4
2.18.8

Open the chart page →

7,984
orderaccount-serviceVerified publisher0.4.21 of 1See more

order account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
vitalii1992/order-service:latest07c4a8833ce4
jackson-core@2.15.0
2.18.8

Open the chart page →

2,305
quotes-provideraccount-serviceVerified publisher0.4.21 of 1See more

quotes-provider account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
vitalii1992/quotes-provider-service:latest44d2d6e00ab3
jackson-core@2.15.0
2.18.8

Open the chart page →

2,293
migrationadeptia-automate-migration5.2.91 of 1See more

migration adeptia-automate-migration 5.2.9

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
adeptiainc/adeptia-connect-migration:5.2.98607f4f29732
jackson-core@2.19.4
2.21.4

Open the chart page →

631
jenkinsaditisingh-jenkins1.0.01 of 1See more

jenkins aditisingh-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-core@2.20.1
2.21.4

Open the chart page →

3,145
airbyte-api-serverairbyteVerified publisher0.293.41 of 1See more

airbyte-api-server airbyte 0.293.4

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
airbyte/airbyte-api-server:0.63.8e1c5e7cfec8a
jackson-core@2.17.1
2.18.8

Open the chart page →

974
airbyte-cronairbyteVerified publisher0.40.371 of 1See more

airbyte-cron airbyte 0.40.37

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
airbyte/cron:0.40.17caf4f551c546
jackson-core@2.13.4
2.18.8

Open the chart page →

1,517
connector-rollout-workerairbyteVerified publisher1.9.21 of 1See more

connector-rollout-worker airbyte 1.9.2

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
airbyte/connector-rollout-worker:2.0.2-alpha-c905e75d42813fcc191
jackson-core@2.20.1
2.21.4

Open the chart page →

995
airports-apiairports-api0.1.01 of 1See more

airports-api airports-api 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
dina1993/airports-api:latestac731244aed1
jackson-core@2.14.2
2.18.8

Open the chart page →

2,056
airports-consumerairports-consumer0.1.01 of 1See more

airports-consumer airports-consumer 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
dina1993/airports-consumer:latest669d146a5e63
jackson-core@2.14.2
2.18.8

Open the chart page →

2,045
airports-kafkaairports-kafka0.1.01 of 2See more

airports-kafka airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-core@2.10.5
2.18.8

Open the chart page →

5,863
airports-producerairports-producer0.1.01 of 1See more

airports-producer airports-producer 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
dina1993/airports-producer:latest3d6b0dac1cb4
jackson-core@2.14.2
2.18.8

Open the chart page →

2,045
airsonic-advancedairsonic-advancedVerified publisher0.3.11 of 1See more

airsonic-advanced airsonic-advanced 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
linuxserver/airsonic-advanced:11.1.4bae6dde843d7
jackson-core@2.17.2
2.18.8

Open the chart page →

2,028
aktoakto0.2.02 of 7See more

akto akto 0.2.0

2 of the 7 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
jackson-core@2.14.2
2.18.8
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
jackson-core@2.13.4
2.18.8

Open the chart page →

15,416
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
jackson-core@2.16.1
2.18.8

Open the chart page →

49,717
akto-central-setupakto1.2.31 of 5See more

akto-central-setup akto 1.2.3

1 of the 5 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
jackson-core@2.21.2
2.21.4

Open the chart page →

4,075
akto-hybrid-redactakto1.44.81 of 5See more

akto-hybrid-redact akto 1.44.8

1 of the 5 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
jackson-core@2.19.0
2.21.4

Open the chart page →

5,453
akto-mini-runtimeakto0.7.221 of 3See more

akto-mini-runtime akto 0.7.22

1 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-core@2.21.2
2.21.4

Open the chart page →

3,405
akto-mini-runtime-shaakto0.7.232 of 3See more

akto-mini-runtime-sha akto 0.7.23

2 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-runtimedigest-pinned4d3a8042c761
jackson-core@2.16.1
2.18.8
public.ecr.aws/aktosecurity/confluentinc-cp-kafkadigest-pinnedd20bd62f0182
jackson-core@2.19.0
2.21.4

Open the chart page →

3,984
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-core@2.21.2
2.21.4

Open the chart page →

8,110
akto-mini-testing-kafkaakto1.42.13 of 5See more

akto-mini-testing-kafka akto 1.42.1

3 of the 5 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.8.0-3-ubi8adc392d28a1e
jackson-core@2.16.0
2.18.8
confluentinc/cp-zookeeper:7.8.0-3-ubi85ca5f3269814
jackson-core@2.16.0
2.18.8
public.ecr.aws/aktosecurity/akto-api-security-mini-testing:improve-testing-performance8e9d15ed71c7
jackson-core@2.16.1
2.18.8

Open the chart page →

7,542
akto-mrs-runtime-combinedakto0.0.22 of 2See more

akto-mrs-runtime-combined akto 0.0.2

2 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime:1.54.4_localb2b97137aef5
jackson-core@2.16.1
2.18.8
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
jackson-core@2.19.0
2.21.4

Open the chart page →

2,422
akto-protectionakto0.1.03 of 4See more

akto-protection akto 0.1.0

3 of the 4 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
aktosecurity/akto-api-protection:localbcd7382c9c1b
jackson-core@2.16.1
2.18.8
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
jackson-core@2.14.2
2.18.8
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
jackson-core@2.13.4
2.18.8

Open the chart page →

12,399
akto-regional-setupakto1.4.41 of 9See more

akto-regional-setup akto 1.4.4

1 of the 9 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
jackson-core@2.21.2
2.21.4

Open the chart page →

47,736
akto-runtimeakto0.1.81 of 2See more

akto-runtime akto 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-core@2.21.2
2.21.4

Open the chart page →

1,853
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
aktosecurity/source-code-analyser:a-1703-merge274042ed7a53
jackson-core@2.16.1
2.18.8

Open the chart page →

6,053
akto-threat-backendakto0.1.51 of 2See more

akto-threat-backend akto 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-core@2.21.2
2.21.4

Open the chart page →

1,886
akto-threat-clientakto0.2.01 of 2See more

akto-threat-client akto 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-core@2.21.2
2.21.4

Open the chart page →

1,917
data-ingestion-serviceakto0.1.61 of 1See more

data-ingestion-service akto 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-68494.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-servicedigest-pinned213aded7adc5
jackson-core@2.16.1
2.18.8

Open the chart page →

63,302

Container images carrying it

921 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/keycloak/keycloak-operator:26.0.68e3a1a56346f
jackson-core@2.17.2
2.18.8
1
quay.io/keycloak/keycloak-operator:20.0.2b1710745fa64
jackson-core@2.13.4
2.18.8
1
quay.io/maximilianopizarro/custom-rhcl-console:dns-prober-v0.1.21a592ee6651a
jackson-core@2.21.2
2.21.4
1
quay.io/maximilianopizarro/neuralbank-backend:latesta53899fcfc01
jackson-core@2.20.0
2.21.4
1
quay.io/maximilianopizarro/showroom-docs-mcp:latest1a6eff92827a
jackson-core@2.21.2
2.21.4
1
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
jackson-core@2.15.3
2.18.8
1
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
jackson-core@2.19.2
2.21.4
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
jackson-core@2.10.1
2.18.8
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
jackson-core@2.14.1
2.18.8
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
jackson-core@2.15.3
2.18.8
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
jackson-core@2.15.3
2.18.8
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
jackson-core@2.15.3
2.18.8
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
jackson-core@2.17.2
2.18.8
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
jackson-core@2.13.5
2.18.8
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
jackson-core@2.12.3
2.18.8
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-core@2.19.2
2.21.4
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-core@2.16.2
2.18.8
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-core@2.13.4
2.18.8
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-core@2.14.2
2.18.8
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-core@2.17.2
2.18.8
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.12ce790a4023b6
jackson-core@2.18.0
2.18.8
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.