StackRadar

CVE-2026-68497

High

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
578
of 17,939 indexed, latest versions
Container images
606
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

Carried by container images the latest versions of 578 of 17,939 indexed charts deploy, on 606 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.14.0, 2.14.1, 2.14.2, 2.14.3+46 more2.18.10, 2.21.6, 2.22.2, 3.1.6+1 more606
OSV records
GHSA-q4xh-88c3-wmh7
Trending
Rank 8 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

578 by stars
ChartLatestAffected imagesRadar Score
allure-docker-helm-chartallure-service-chartVerified publisher0.1.01 of 2See more

allure-docker-helm-chart allure-service-chart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:latestdc171ec796d5
jackson-databind@2.22.0
2.22.2

Open the chart page →

3,838
amorphieamorphie0.1.24 of 18See more

amorphie amorphie 0.1.2

4 of the 18 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
camunda/zeebe:8.4.5ab5abc09e407
jackson-databind@2.16.1
2.18.10
hazelcast/hazelcast:5.3.18fe26efde8e1
jackson-databind@2.15.2
2.18.10
hazelcast/management-center:5.3.2f9d34300d330
jackson-databind@2.15.2
2.18.10
ghcr.io/camunda-community-hub/zeebe-simple-monitor:2.6.2d9d796a1b846
jackson-databind@2.15.3
2.18.10

Open the chart page →

29,178
monitoringantmediaVerified publisher1.0.01 of 6See more

monitoring antmedia 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
jackson-databind@2.16.2
2.18.10

Open the chart page →

2,515
apishiftapishiftVerified publisher0.3.01 of 4See more

apishift apishift 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/everythingascode/apishift-backend:v0.3.014ff275b2e61
jackson-databind@2.22.0
2.22.2

Open the chart page →

3,038
apispringbootHelmapispringboot0.1.01 of 1See more

apispringbootHelm apispringboot 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
rabeh/apibootspring:1.0941007b6946e
jackson-databind@2.15.3
2.18.10

Open the chart page →

6,491
inbox-serverappscodeVerified publisher2025.12.251 of 1See more

inbox-server appscode 2025.12.25

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:postgres-latest536358d7b17e
jackson-databind@2.19.1
2.21.6

Open the chart page →

4,340
inbox-server-distributedappscodeVerified publisher2025.12.251 of 4See more

inbox-server-distributed appscode 2025.12.25

1 of the 4 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:latest536358d7b17e
jackson-databind@2.19.1
2.21.6

Open the chart page →

16,689
james-komposeappscodeVerified publisher0.1.01 of 4See more

james-kompose appscode 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
jackson-databind@2.15.2
2.18.10

Open the chart page →

18,071
kafka-uiappscodeVerified publisher2026.3.301 of 1See more

kafka-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
jackson-databind@2.21.2
2.21.6

Open the chart page →

828
arlas-aiasarlas-stackVerified publisher28.9.05 of 22See more

arlas-aias arlas-stack 28.9.0

5 of the 22 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
jackson-databind@2.15.0
2.18.10
bitnamilegacy/keycloak:26.3.3-debian-12-r0da3df0976a9f
jackson-databind@2.18.2
2.18.10
gisaia/arlas-permissions-server:28.0.0e612fc722e02
jackson-databind@2.21.0
2.21.6
gisaia/arlas-persistence-server:28.0.0f667e0ee79be
jackson-databind@2.21.0
2.21.6
gisaia/arlas-server:28.0.04e693e7b6f37
jackson-databind@2.21.0
2.21.6

Open the chart page →

41,768
arlas-servicesarlas-stackVerified publisher28.9.03 of 3See more

arlas-services arlas-stack 28.9.0

3 of the 3 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
gisaia/arlas-permissions-server:28.0.0e612fc722e02
jackson-databind@2.21.0
2.21.6
gisaia/arlas-persistence-server:28.0.0f667e0ee79be
jackson-databind@2.21.0
2.21.6
gisaia/arlas-server:28.0.04e693e7b6f37
jackson-databind@2.21.0
2.21.6

Open the chart page →

1,866
automatedconfigurationassist-iot-automated-configuration1.0.03 of 5See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

3 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.5.1dc9b972db002
jackson-databind@2.14.2
2.18.10
confluentinc/cp-zookeeper:7.5.10bec03c1f3ce
jackson-databind@2.14.2
2.18.10
provectuslabs/kafka-ui:latest8f2ff02d64b0
jackson-databind@2.15.2
2.18.10

Open the chart page →

15,548
axelor-open-suiteaxelor-open-suiteVerified publisher7.2.581 of 2See more

axelor-open-suite axelor-open-suite 7.2.58

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
jackson-databind@2.14.0
2.18.10

Open the chart page →

9,857
keycloakbarravarVerified publisher1.0.41 of 1See more

keycloak barravar 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:24.0.34d6f22991266
jackson-databind@2.16.1
2.18.10

Open the chart page →

2,584
blackduck-alertblackduck8.4.11 of 4See more

blackduck-alert blackduck 8.4.1

1 of the 4 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
blackducksoftware/blackduck-alert:8.4.1b66c8385ba53
jackson-databind@2.17.3
2.18.10

Open the chart page →

1,604
bluerange-serverbluerangeOfficialVerified publisher1.4.01 of 1See more

bluerange-server bluerange 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
bluerange/bluerange:26.2.0503577ef9143
jackson-databind@2.18.3
2.18.10

Open the chart page →

1,897
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-agg:logbc25b152d88e
jackson-databind@2.18.2
2.18.10

Open the chart page →

29,075
jenkinsbook-k8sinfra-v25.1.121 of 2See more

jenkins book-k8sinfra-v2 5.1.12

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
jenkins/jenkins:2.440.3-jdk17de4fea113221
jackson-databind@2.17.0
2.18.10

Open the chart page →

8,576
casepack-apibysamioVerified publisher0.32.01 of 1See more

casepack-api bysamio 0.32.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/bysamio/casepack-api:0.32.067aa72b00d0a
jackson-databind@2.21.4
2.21.6

Open the chart page →

93
keycloakbysamioVerified publisher1.4.11 of 2See more

keycloak bysamio 1.4.1

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/bysamio/keycloak:26.7.48360a1f317b8
jackson-databind@2.21.5
2.21.6

Open the chart page →

104
kafkacagriekinVerified publisher0.2.01 of 2See more

kafka cagriekin 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apache/kafka:4.1.0bff074a5d005
jackson-databind@2.19.0
2.21.6

Open the chart page →

2,532
camellia-redis-proxycamellia-redis-proxy1.4.01 of 2See more

camellia-redis-proxy camellia-redis-proxy 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
48n6e/camellia-redis-proxy:1.4.0-jdk-21-0.0.1a6ed886fddfc
jackson-databind@2.19.4
2.21.6

Open the chart page →

8,425
puppetservercamptocamp31.0.11 of 2See more

puppetserver camptocamp3 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
jackson-databind@2.14.0
2.18.10

Open the chart page →

6,200
opensearch-singlenodecaptnbpVerified publisher1.0.91 of 2See more

opensearch-singlenode captnbp 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.15.01963b3ece46d
jackson-databind@2.17.1
2.18.10

Open the chart page →

1,282
metabasecasemark2.16.111 of 1See more

metabase casemark 2.16.11

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
jackson-databind@2.14.0
2.18.10

Open the chart page →

1,257
keycloak-mcp-serverchristianhuthVerified publisher1.2.01 of 1See more

keycloak-mcp-server christianhuth 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-databind@2.22.0
2.22.2

Open the chart page →

1,557
rpc-routerchronicleVerified publisher0.2.101 of 1See more

rpc-router chronicle 0.2.10

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
drpcorg/dshackle:0.54.08858fae1859d
jackson-databind@2.14.2
2.18.10

Open the chart page →

6,834
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
jackson-databind@2.20.1
2.21.6

Open the chart page →

7,511
gitea-jenkinsclusterfactory0.1.11 of 5See more

gitea-jenkins clusterfactory 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
jackson-databind@2.20.1
2.21.6

Open the chart page →

7,284
castlemockcnieg2.0.11 of 1See more

castlemock cnieg 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
castlemock/castlemock:latestb7f3f1527ba9
jackson-databind@2.18.3
2.18.10

Open the chart page →

4,887
opencloudcommunity-opencloud3.1.01 of 13See more

opencloud community-opencloud 3.1.0

1 of the 13 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apache/tika:latest-full80072bb73dd3
jackson-databind@2.22.1
2.22.2

Open the chart page →

9,829
custom-rhcl-consolecustom-rhcl-consoleVerified publisher0.1.21 of 3See more

custom-rhcl-console custom-rhcl-console 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/custom-rhcl-console:dns-prober-v0.1.21a592ee6651a
jackson-databind@2.21.2
2.21.6

Open the chart page →

2,005
nifi-registryd4nVerified publisher1.0.01 of 2See more

nifi-registry d4n 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
jackson-databind@2.17.0
2.18.10

Open the chart page →

5,781
dadosfake-helmdadosfake-app0.1.01 of 1See more

dadosfake-helm dadosfake-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
javaaurelio/dadosfake_web_springboot:latest8541a3cd021a
jackson-databind@2.15.3
2.18.10

Open the chart page →

2,101
damap-chartdamapVerified publisher0.3.12 of 5See more

damap-chart damap 0.3.1

2 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/damap-org/damap-backend:5.0.10d5166b01eec
jackson-databind@2.17.1
2.18.10
quay.io/keycloak/keycloak:26.545ae20191531
jackson-databind@2.21.2
2.21.6

Open the chart page →

14,341
dara-chartsdara-charts0.1.01 of 2See more

dara-charts dara-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
razzy10/product-service:latest702e411956db
jackson-databind@2.19.2
2.21.6

Open the chart page →

3,414
kafka-connectdasmeta1.0.21 of 3See more

kafka-connect dasmeta 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
confluentinc/cp-schema-registry:latest482d3048b3f6
jackson-databind@2.22.1
2.22.2

Open the chart page →

260
metabasedasmeta0.1.01 of 1See more

metabase dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
metabase/metabase:v0.63.1.124f150effd484
jackson-databind@2.21.5
2.21.6

Open the chart page →

892
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
datagrok/grok_connect:latestf5876d3aebb8
jackson-databind@2.18.9
2.18.10

Open the chart page →

2,467
datagrok_grok_connectdatagrok1.0.01 of 1See more

datagrok_grok_connect datagrok 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
datagrok/grok_connect:latestf5876d3aebb8
jackson-databind@2.18.9
2.18.10

Open the chart page →

1,824
db2restdb2rest0.2.01 of 1See more

db2rest db2rest 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
kdhrubo/db2rest:lateste20610ff81b0
jackson-databind@2.19.2
2.21.6

Open the chart page →

984
deployhubdeployhubVerified publisher10.0.4151 of 11See more

deployhub deployhub 10.0.415

1 of the 11 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/deployhub/ms-ui:svccat-v11.0.815-g717581f5dedbc31e6f
jackson-databind@2.14.2
2.18.10

Open the chart page →

11,911
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
epam/ai-dial-admin-backend:0.21.08b91130e3731
jackson-databind@2.22.1
2.22.2

Open the chart page →

3,846
kafka-uidoubanVerified publisher1.5.21 of 1See more

kafka-ui douban 1.5.2

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
jackson-databind@2.18.2
2.18.10

Open the chart page →

1,389
entrypoint-balancereclipse-aeriosVerified publisher1.3.01 of 1See more

entrypoint-balancer eclipse-aerios 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
eclipseaerios/entrypoint-balancer:1.3.043cd999a008d
jackson-databind@2.15.4
2.18.10

Open the chart page →

2,613
idmeclipse-aeriosVerified publisher2.0.01 of 2See more

idm eclipse-aerios 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.6.39b0330756022
jackson-databind@2.21.2
2.21.6

Open the chart page →

4,919
management-portaleclipse-aeriosVerified publisher1.1.01 of 2See more

management-portal eclipse-aerios 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
eclipseaerios/management-portal-backend:1.2.215fba526a4f8
jackson-databind@2.15.4
2.18.10

Open the chart page →

4,038
unifiegebackVerified publisher2.1.61 of 1See more

unifi egeback 2.1.6

1 of the 1 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
jacobalberty/unifi:v10.0.162896c0ab82d33
jackson-databind@2.17.3
2.18.10

Open the chart page →

7,829
egeria-baseegeria-charts4.3.01 of 5See more

egeria-base egeria-charts 4.3.0

1 of the 5 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
jackson-databind@2.15.2
2.18.10

Open the chart page →

4,205
egeria-ctsegeria-charts4.3.01 of 3See more

egeria-cts egeria-charts 4.3.0

1 of the 3 container images this version deploys carry CVE-2026-68497.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
jackson-databind@2.15.2
2.18.10

Open the chart page →

4,192

Container images carrying it

606 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-databind@2.22.0
2.22.2
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-databind@2.19.2
2.21.6
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-databind@2.16.2
2.18.10
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-databind@2.14.2
2.18.10
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-databind@2.17.2
2.18.10
1
registry.gitlab.com/lenitech/docker/keycloak:26.7.4-0993dd8a5e1f8
jackson-databind@2.21.5
2.21.6
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.