StackRadar

CVE-2026-68497

High

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
578
of 17,939 indexed, latest versions
Container images
606
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

Carried by container images the latest versions of 578 of 17,939 indexed charts deploy, on 606 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.14.0, 2.14.1, 2.14.2, 2.14.3+46 more2.18.10, 2.21.6, 2.22.2, 3.1.6+1 more606
OSV records
GHSA-q4xh-88c3-wmh7
Trending
Rank 8 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

578 by stars
ChartLatestAffected imagesRadar Score
axelixaxelixVerified publisher1.1.01 of 1See more

axelix axelix 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/axelixlabs/axelix:1.1.0449dc880bbfb
jackson-databind@3.1.5
3.1.6

Open the chart page →

95
crushftpcrushftp0.0.142 of 3See more

crushftp crushftp 0.0.14

2 of the 3 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
crushftp/crushftp11:latest-dev7fb4636f28c3
jackson-databind@2.21.4
2.21.6
crushftp/crushftp11:latestf91eac198848
jackson-databind@2.21.4
2.21.6

Open the chart page →

134
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.1-debian-11-r29cfd2df1294d
jackson-databind@2.15.0
2.18.10

Open the chart page →

83,471
dialdialOfficialVerified publisher8.0.01 of 4See more

dial dial 8.0.0

1 of the 4 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
epam/ai-dial-core:0.48.0414b85d32145
jackson-databind@2.21.5
2.21.6

Open the chart page →

2,062
kpowfactorhouseOfficialVerified publisher1.0.841 of 1See more

kpow factorhouse 1.0.84

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
factorhouse/kpow:96.55994fa3bacce
jackson-databind@3.2.0
3.2.2

Open the chart page →

51
geonode-k8sgeonode-k8sVerified publisher2.0.01 of 10See more

geonode-k8s geonode-k8s 2.0.0

1 of the 10 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
geonode/geoserver:2.28.4-latest81b1d431b7e9
jackson-databind@2.21.0
2.21.6

Open the chart page →

62,397
openhabhelmforgeVerified publisher1.2.01 of 1See more

openhab helmforge 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
openhab/openhab:5.2.1bfd4a60e90da
jackson-databind@2.21.4
2.21.6

Open the chart page →

4,041
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
jackson-databind@2.18.2
2.18.10
apache/hertzbeat-collector:1.8.0a2bab1be574c
jackson-databind@2.18.2
2.18.10

Open the chart page →

14,711
infrahubinfrahubVerified publisher4.33.31 of 5See more

infrahub infrahub 4.33.3

1 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
library/neo4j:2026.05.06c162e2432f8
jackson-databind@2.21.3
2.21.6

Open the chart page →

11,219
jenkinsjenkins-helm-chartVerified publisher0.1.01 of 1See more

jenkins jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

2,688
kubernetes-loggingkubernetes-logging4.8.02 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

2 of the 6 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
jackson-databind@2.14.1
2.18.10
opensearchproject/opensearch:2.10.0c8f3ebd2a934
jackson-databind@2.15.2
2.18.10

Open the chart page →

11,114
musicocielmusicocielVerified publisher0.0.01 of 3See more

musicociel musicociel 0.0.0

1 of the 3 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:23.0.34f72a5b0c076
jackson-databind@2.15.2
2.18.10

Open the chart page →

4,611
scm-managerscm-manager3.12.11 of 1See more

scm-manager scm-manager 3.12.1

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
scmmanager/scm-manager:3.12.1bfb766050f34
jackson-databind@2.21.1
2.21.6

Open the chart page →

760
nexus3stevehipwell-helm-charts-nexus3Verified publisher5.26.11 of 2See more

nexus3 stevehipwell-helm-charts-nexus3 5.26.1

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
sonatype/nexus3:3.96.3-ubicead2aaf041f
jackson-databind@3.2.1
3.2.2

Open the chart page →

47
geoservercloudcamptocamp23.0.17 of 7See more

geoservercloud camptocamp2 3.0.1

7 of the 7 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-gateway:3.0.1.1de0b20bd2a43
jackson-databind@3.1.2
3.1.6
geoservercloud/geoserver-cloud-gwc:3.0.1.1b04ed89b5d2b
jackson-databind@2.21.0
2.21.6
geoservercloud/geoserver-cloud-rest:3.0.1.1318254b52f96
jackson-databind@3.1.2
3.1.6
geoservercloud/geoserver-cloud-wcs:3.0.1.14f077124f591
jackson-databind@2.21.0
2.21.6
geoservercloud/geoserver-cloud-webui:3.0.1.14f91e3048ac8
jackson-databind@2.21.0
2.21.6
geoservercloud/geoserver-cloud-wfs:3.0.1.1299f0d6232d1
jackson-databind@3.1.2
3.1.6
geoservercloud/geoserver-cloud-wms:3.0.1.15164f687ce4d
jackson-databind@2.21.0
2.21.6

Open the chart page →

12,395
opensearchcaptnbpVerified publisher3.1.11 of 2See more

opensearch captnbp 3.1.1

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.269588c664014
jackson-databind@2.18.2
2.18.10

Open the chart page →

1,210
thingsboardcetic0.1.21 of 2See more

thingsboard cetic 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
thingsboard/tb-postgres:latest2d17e4e36edc
jackson-databind@2.18.4
2.18.10

Open the chart page →

5,702
convertigoconvertigoOfficialVerified publisher8.4.42 of 5See more

convertigo convertigo 8.4.4

2 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
library/convertigo:8.4.45b84c3568940
jackson-databind@2.22.1
2.22.2
library/couchdb:3.58cf5f8442585
jackson-databind@2.21.0
2.21.6

Open the chart page →

15,734
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/keycloak:0.13.0b37408461b9b
jackson-databind@2.19.2
2.21.6

Open the chart page →

30,770
cosmotech-apicosmotech-apiVerified publisher5.3.01 of 1See more

cosmotech-api cosmotech-api 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-api:5.3.0b9d7cb4aa93d
jackson-databind@2.22.1
2.22.2

Open the chart page →

119
ejbca-ceejbcaOfficialVerified publisher9.6.31 of 1See more

ejbca-ce ejbca 9.6.3

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
keyfactor/ejbca-ce:9.6.3ef574ed81c1e
jackson-databind@2.21.3
2.21.6

Open the chart page →

1,040
flowableflowable-oss7.1.01 of 2See more

flowable flowable-oss 7.1.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
flowable/flowable-rest:7.1.0b7ae287502cd
jackson-databind@2.17.2
2.18.10

Open the chart page →

2,936
flyte-binaryflyte2.0.501 of 4See more

flyte-binary flyte 2.0.50

1 of the 4 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
jackson-databind@2.19.2
2.21.6

Open the chart page →

4,338
aegraviteeioVerified publisher3.0.21 of 1See more

ae graviteeio 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
graviteeio/ae-engine:3.0.24140932887e0
jackson-databind@2.18.3
2.18.10

Open the chart page →

1,499
apimgraviteeioVerified publisher4.12.202 of 4See more

apim graviteeio 4.12.20

2 of the 4 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
graviteeio/apim-gateway:4.12.20-debian8f1a14449381
jackson-databind@2.18.1
2.18.10
graviteeio/apim-management-api:4.12.20-debiand30d085395ca
jackson-databind@2.21.2
2.21.6

Open the chart page →

4,865
nacosgujunxiang0.1.51 of 1See more

nacos gujunxiang 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
jackson-databind@2.21.2
2.21.6

Open the chart page →

2,086
hazelcasthazelcastVerified publisher5.10.32 of 2See more

hazelcast hazelcast 5.10.3

2 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
hazelcast/hazelcast:5.5.05dd5d31c7a06
jackson-databind@2.17.2
2.18.10
hazelcast/management-center:5.5.20095e0320623
jackson-databind@2.17.2
2.18.10

Open the chart page →

3,038
infrahub-enterpriseinfrahub-enterpriseVerified publisher4.19.31 of 5See more

infrahub-enterprise infrahub-enterprise 4.19.3

1 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
library/neo4j:2026.05.0-enterprise2caf944aa4a5
jackson-databind@2.21.3
2.21.6

Open the chart page →

11,333
me-untethr-nostr-relaykronkltdVerified publisher0.1.41 of 1See more

me-untethr-nostr-relay kronkltd 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
duck1123/me.untethr.nostr-relay:0.2.1119fc5d4cbfb
jackson-databind@2.14.1
2.18.10

Open the chart page →

2,105
oesopsmxVerified publisher4.0.324 of 25See more

oes opsmx 4.0.32

4 of the 25 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
jackson-databind@2.14.1
2.18.10
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
jackson-databind@2.15.3
2.18.10
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
jackson-databind@2.15.3
2.18.10
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
jackson-databind@2.15.3
2.18.10

Open the chart page →

103,166
repoflowrepoflow-helm-public0.9.11 of 8See more

repoflow repoflow-helm-public 0.9.1

1 of the 8 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
library/elasticsearch:8.15.0310b9fc03b06
jackson-databind@2.15.0
2.18.10

Open the chart page →

13,231
rocketmq-clusterrocketmq12.6.01 of 2See more

rocketmq-cluster rocketmq 12.6.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
jackson-databind@2.18.3
2.18.10

Open the chart page →

6,739
skypilotskypilotOfficialVerified publisher0.13.01 of 3See more

skypilot skypilot 0.13.0

1 of the 3 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
jackson-databind@2.18.6
2.18.10

Open the chart page →

6,302
snowplow-iglu-serversnowplow-devopsOfficialVerified publisher0.19.01 of 1See more

snowplow-iglu-server snowplow-devops 0.19.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
snowplow/iglu-server:0.12.0-distroless5a38033f07c1
jackson-databind@2.14.1
2.18.10

Open the chart page →

278
kafka-chartsoldevelo-kafka-chart32.4.41 of 1See more

kafka-chart soldevelo-kafka-chart 32.4.4

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
soldevelo/kafka:4.0.0-debian-12-r0cfdc08c2f577
jackson-databind@2.16.2
2.18.10

Open the chart page →

2,579
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
jackson-databind@2.15.2
2.18.10

Open the chart page →

15,079
feedbacksystemthm-mni-iiVerified publisher0.48.03 of 14See more

feedbacksystem thm-mni-ii 0.48.0

3 of the 14 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/thm-mni-ii/fbs-core:v2.0.1b585ab8bb7e8
jackson-databind@2.14.2
2.18.10
ghcr.io/thm-mni-ii/fbs-identity-service:v2.0.1baf79539e5df
jackson-databind@2.21.2
2.21.6
ghcr.io/thm-mni-ii/fbs-runner:v2.0.15d7506dce446
jackson-databind@2.14.2
2.18.10

Open the chart page →

25,559
structurizrvirtualrootVerified publisher0.5.01 of 1See more

structurizr virtualroot 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
structurizr/onpremises:2025.11.094b5ffb5119c8
jackson-databind@2.20.0
2.21.6

Open the chart page →

4,794
migrationadeptia-connect-migrationVerified publisher4.8.11 of 1See more

migration adeptia-connect-migration 4.8.1

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
adeptiainc/adeptia-connect-migration:4.8.1f1087da3da0b
jackson-databind@2.21.1
2.21.6

Open the chart page →

608
keycloak-operatoradfinisVerified publisher1.13.01 of 1See more

keycloak-operator adfinis 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak-operator:26.7.268b1e5805b99
jackson-databind@2.21.5
2.21.6

Open the chart page →

107
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apache/tika:2.9.0.092d055a84e9e
jackson-databind@2.15.2
2.18.10

Open the chart page →

22,217
icat-k8salba-helm-chartsVerified publisher1.1.02 of 4See more

icat-k8s alba-helm-charts 1.1.0

2 of the 4 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
payara/micro:7.2026.2-jdk25fb44b8ce1cb2
jackson-databind@2.21.0
2.21.6
payara/server-full:7.2026.2-jdk2531f1253f0cf8
jackson-databind@2.21.0
2.21.6

Open the chart page →

4,307
apache-rangerapache-ranger0.1.01 of 2See more

apache-ranger apache-ranger 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apache/ranger:2.7.076c176e8a0e4
jackson-databind@2.17.2
2.18.10

Open the chart page →

8,227
tikaapache-tika3.2.21 of 1See more

tika apache-tika 3.2.2

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apache/tika:3.2.2.0-fullffab324253ed
jackson-databind@2.19.2
2.21.6

Open the chart page →

499
nacosbytectl0.1.61 of 1See more

nacos bytectl 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
jackson-databind@2.21.2
2.21.6

Open the chart page →

2,086
cbioportalcbioportalOfficialVerified publisher1.1.01 of 1See more

cbioportal cbioportal 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
jackson-databind@2.19.2
2.21.6

Open the chart page →

4,034
cert-vaultcert-vaultOfficialVerified publisher2.12.01 of 7See more

cert-vault cert-vault 2.12.0

1 of the 7 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
jackson-databind@2.19.4
2.21.6

Open the chart page →

16,603
kafkacloudpirates-kafkaVerified publisher0.1.71 of 1See more

kafka cloudpirates-kafka 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apache/kafka:4.3.177e3df905404
jackson-databind@2.21.2
2.21.6

Open the chart page →

660
cp-schema-registrycp-schema-registryVerified publisher1.0.01 of 1See more

cp-schema-registry cp-schema-registry 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
jackson-databind@2.19.0
2.21.6

Open the chart page →

2,119
nifid4nVerified publisher2.0.01 of 5See more

nifi d4n 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
jackson-databind@2.17.0
2.18.10

Open the chart page →

5,781

Container images carrying it

606 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-databind@2.22.0
2.22.2
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-databind@2.19.2
2.21.6
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-databind@2.16.2
2.18.10
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-databind@2.14.2
2.18.10
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-databind@2.17.2
2.18.10
1
registry.gitlab.com/lenitech/docker/keycloak:26.7.4-0993dd8a5e1f8
jackson-databind@2.21.5
2.21.6
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.