CVE-2026-68494
HighAdvisory
Published 21 Jul 2026In the index since 3 Oct 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.005
- 38th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 925
- of 18,026 indexed, latest versions
- Container images
- 913
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Carried by container images the latest versions of 925 of 18,026 indexed charts deploy, on 913 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jackson-coremaven | 2.0.5, 2.2.3, 2.3.0, 2.3.3+91 more | 2.18.8, 2.21.4, 3.1.4 | 913 |
- OSV records
- GHSA-r7wm-3cxj-wff9
Charts affected
925 by stars
Container images carrying it
913 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| geoservercloud/ | 47ae1bdb4bcc | jackson-core | 2.18.8 | 1 |
| geoservercloud/ | 4f077124f591 | jackson-core | 2.21.4 | 1 |
| geoservercloud/ | 28c3e5a8c5a3 | jackson-core | 2.18.8 | 1 |
| geoservercloud/ | 4f91e3048ac8 | jackson-core | 3.1.4 | 1 |
| geoservercloud/ | 299f0d6232d1 | jackson-core | 3.1.4 | 1 |
| geoservercloud/ | 8c70ee06d5ab | jackson-core | 2.18.8 | 1 |
| geoservercloud/ | 42775ba6a4da | jackson-core | 2.18.8 | 1 |
| geoservercloud/ | 5164f687ce4d | jackson-core | 2.21.4 | 1 |
| glasskube/ | be5133100d63 | jackson-core | 2.18.8 | 1 |
| gluufederation/ | 1a1128b28b95 | jackson-core | 2.18.8 | 1 |
| gocd/ | 2da45cb09d57 | jackson-core | 2.18.8 | 1 |
| golenski/ | c863dcb0c513 | jackson-core | 2.18.8 | 1 |
| golenski/ | 3a2b36df247b | jackson-core | 2.18.8 | 1 |
| golenski/ | 954caf4aaf6a | jackson-core | 2.18.8 | 1 |
| gotson/ | 9b15ea6bfc30 | jackson-core | 2.18.8 | 1 |
| gotson/ | ba892ab3e082 | jackson-core | 2.18.8 | 1 |
| gradiant/ | e3bf364fe713 | jackson-core | 2.18.8 | 1 |
| gradiant/ | 45eceb1bc55c | jackson-core | 2.18.8 | 1 |
| graviteeio/ | 4140932887e0 | jackson-core | 2.18.8 | 1 |
| graylog2/ | 8ff28c66e6c1 | jackson-core | 2.18.8 | 1 |
| graylog/ | 19de1aff48c2 | jackson-core | 2.18.8 | 1 |
| graylog/ | 598bd41fefd5 | jackson-core | 2.21.4 | 1 |
| graylog/ | 8a1f641cd7aa | jackson-core | 2.21.4 | 1 |
| gresearchdev/ | 91863a50afb7 | jackson-core | 2.18.8 | 1 |
| gresearchdev/ | 8dad36a05ebf | jackson-core | 2.18.8 | 1 |
| gridgain/ | 5ab838d7d3cb | jackson-core | 2.21.4 | 1 |
| gridgain/ | d32d182a0e6a | jackson-core | 2.18.8 | 1 |
| gridgain/ | 95018390077b | jackson-core | 2.21.4 | 1 |
| guacamole/ | 0f62f6d17ab3 | jackson-core | 2.18.8 | 1 |
| gurolakman/ | 9abb3882bcbd | jackson-core | 2.18.8 | 1 |
| gurolakman/ | 6537e8ed8de8 | jackson-core | 2.18.8 | 1 |
| gurolakman/ | ce23b20a8a17 | jackson-core | 2.18.8 | 1 |
| gurolakman/ | b22e746edd5d | jackson-core | 2.18.8 | 1 |
| gurolakman/ | bf18525c5ad9 | jackson-core | 2.18.8 | 1 |
| gurolakman/ | 8739565c3ea2 | jackson-core | 2.18.8 | 1 |
| hazelcast/ | 8fe26efde8e1 | jackson-core | 2.18.8 | 1 |
| hazelcast/ | ca7d5589744f | jackson-core | 2.18.8 | 1 |
| hazelcast/ | f086bf0ecb23 | jackson-core | 2.21.4 | 1 |
| hazelcast/ | a825ecbe9fda | jackson-core | 2.18.8 | 1 |
| hazelcast/ | df495e64ea65 | jackson-core | 2.18.8 | 1 |
| hazelcast/ | f9d34300d330 | jackson-core | 2.18.8 | 1 |
| hivemq/ | 4d194450d48e | jackson-core | 2.18.8 | 1 |
| hivemq/ | d8250a233cea | jackson-core | 2.21.4 | 1 |
| hivemq/ | 241d6a8e1963 | jackson-core | 2.18.8 | 1 |
| holoinsight/ | 88978988756b | jackson-core | 2.18.8 | 1 |
| housewrecker/ | f417dd0a7547 | jackson-core | 2.18.8 | 1 |
| huajuan6848/ | a303f3d9f6e0 | jackson-core | 2.18.8 | 1 |
| huertaslopez/ | e2c18bd65472 | jackson-core | 2.18.8 | 1 |
| hugohg34/ | 171f61e8d7e2 | jackson-core | 2.18.8 | 1 |
| hugohg34/ | 812a03b3f274 | jackson-core | 2.18.8 | 1 |