StackRadar

CVE-2026-89407

High

Advisory

Published 1 Oct 2026In the index since 2 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
48th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
464
of 17,985 indexed, latest versions
Container images
493
deployed by those charts
Fix available
1 of 1
affected package

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Carried by container images the latest versions of 464 of 17,985 indexed charts deploy, on 493 images.

Affected packageAffected versionsFixed inImages
jackson-coremaven2.17.0, 2.17.1, 2.17.2, 2.17.3+37 more2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more493
OSV records
GHSA-p6pp-m3f8-5c89

Charts affected

464 by stars
ChartLatestAffected imagesRadar Score
mod-invoicefolio-org0.1.351 of 1See more

mod-invoice folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-invoice:latest45b7b13e81e1
jackson-core@3.1.4
3.1.7

Open the chart page →

571
mod-invoice-storagefolio-org0.1.341 of 1See more

mod-invoice-storage folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-invoice-storage:latest0bc720abcb78
jackson-core@3.1.5
3.1.7

Open the chart page →

226
mod-kb-ebsco-javafolio-org0.1.351 of 1See more

mod-kb-ebsco-java folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-kb-ebsco-java:latestfe66c7497864
jackson-core@3.1.6
3.1.7

Open the chart page →

0
mod-licensesfolio-org0.1.321 of 1See more

mod-licenses folio-org 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-licenses:latestcfd6109bf477
jackson-core@3.1.3
3.1.7

Open the chart page →

1,787
mod-login-samlfolio-org0.1.341 of 1See more

mod-login-saml folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-login-saml:latest5f3358ccaa0f
jackson-core@2.21.2
2.21.7

Open the chart page →

1,097
mod-ncipfolio-org0.1.341 of 1See more

mod-ncip folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-ncip:latest8ed83674352b
jackson-core@2.18.2
2.18.11

Open the chart page →

1,111
mod-notesfolio-org0.1.341 of 1See more

mod-notes folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-notes:latest998ac4782e0d
jackson-core@3.1.5
3.1.7

Open the chart page →

157
mod-notifyfolio-org0.1.341 of 1See more

mod-notify folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-notify:latesta8c1a90005fc
jackson-core@3.1.4
3.1.7

Open the chart page →

272
mod-oafolio-org0.1.21 of 1See more

mod-oa folio-org 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-oa:latestae3b069d4ba5
jackson-core@2.18.7
2.18.11

Open the chart page →

1,735
mod-oai-pmhfolio-org0.1.341 of 1See more

mod-oai-pmh folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-oai-pmh:latest5cd5ef063f2a
jackson-core@2.18.2
2.18.11

Open the chart page →

966
mod-ordersfolio-org0.1.341 of 1See more

mod-orders folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-orders:latestfc4528220fb8
jackson-core@3.1.4
3.1.7

Open the chart page →

458
mod-orders-storagefolio-org0.1.351 of 1See more

mod-orders-storage folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-orders-storage:latestceeaacc3bf16
jackson-core@2.22.0
2.22.3

Open the chart page →

443
mod-organizationsfolio-org0.1.341 of 1See more

mod-organizations folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-organizations:latest7dc9ccf3d937
jackson-core@2.18.6
2.18.11

Open the chart page →

814
mod-organizations-storagefolio-org0.1.341 of 1See more

mod-organizations-storage folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-organizations-storage:lateste46892405fde
jackson-core@2.21.4
2.21.7

Open the chart page →

670
mod-password-validatorfolio-org0.1.341 of 1See more

mod-password-validator folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-password-validator:latestb31d75f2bf7b
jackson-core@3.1.4
3.1.7

Open the chart page →

395
mod-patronfolio-org0.1.341 of 1See more

mod-patron folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-patron:latest5f213acfe2f8
jackson-core@2.18.2
2.18.11

Open the chart page →

832
mod-patron-blocksfolio-org0.1.341 of 1See more

mod-patron-blocks folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-patron-blocks:latestde7318069a67
jackson-core@2.21.5
2.21.7

Open the chart page →

360
mod-permissionsfolio-org0.1.351 of 1See more

mod-permissions folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-permissions:latest5363e98c6299
jackson-core@2.18.6
2.18.11

Open the chart page →

1,223
mod-pubsubfolio-org0.1.341 of 1See more

mod-pubsub folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-pubsub:latest0a4fa4ad5d72
jackson-core@2.18.6
2.18.11

Open the chart page →

1,017
mod-quick-marcfolio-org0.1.351 of 1See more

mod-quick-marc folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-quick-marc:latest4d70ebda4d00
jackson-core@2.21.5
2.21.7

Open the chart page →

63
mod-remote-storagefolio-org0.1.321 of 1See more

mod-remote-storage folio-org 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-remote-storage:latest4f12177123dc
jackson-core@2.17.2
2.18.11

Open the chart page →

572
mod-rtacfolio-org0.1.341 of 1See more

mod-rtac folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-rtac:latestc959b2d6142f
jackson-core@2.18.2
2.18.11

Open the chart page →

669
mod-searchfolio-org0.1.351 of 1See more

mod-search folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-search:latest44d7ee9acdf6
jackson-core@3.1.5
3.1.7

Open the chart page →

1,561
mod-senderfolio-org0.1.341 of 1See more

mod-sender folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-sender:latestd88a675dddf0
jackson-core@2.18.2
2.18.11

Open the chart page →

822
mod-serials-managementfolio-org0.1.11 of 1See more

mod-serials-management folio-org 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-serials-management:latest571fa1ffe8c9
jackson-core@2.18.7
2.18.11

Open the chart page →

1,735
mod-service-interactionfolio-org0.1.61 of 1See more

mod-service-interaction folio-org 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-service-interaction:latestf53c327a48e8
jackson-core@2.18.7
2.18.11

Open the chart page →

1,735
mod-source-record-managerfolio-org0.1.371 of 1See more

mod-source-record-manager folio-org 0.1.37

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-source-record-manager:latesta940caf026ee
jackson-core@3.1.5
3.1.7

Open the chart page →

59
mod-source-record-storagefolio-org0.1.371 of 1See more

mod-source-record-storage folio-org 0.1.37

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-source-record-storage:latesta1434881eeb7
jackson-core@3.1.6
3.1.7

Open the chart page →

11
mod-tagsfolio-org0.1.341 of 1See more

mod-tags folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-tags:latest6e8beeb70272
jackson-core@3.1.4
3.1.7

Open the chart page →

343
mod-template-enginefolio-org0.1.341 of 1See more

mod-template-engine folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-template-engine:latestd105c585da30
jackson-core@2.18.2
2.18.11

Open the chart page →

822
mod-user-importfolio-org0.1.341 of 1See more

mod-user-import folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-user-import:latest1807734472bd
jackson-core@2.18.6
2.18.11

Open the chart page →

1,223
mod-usersfolio-org0.1.341 of 1See more

mod-users folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-users:latest6f60033321b0
jackson-core@2.21.4
2.21.7

Open the chart page →

432
mod-users-blfolio-org0.1.351 of 1See more

mod-users-bl folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/mod-users-bl:latest4e2d96c9340d
jackson-core@2.18.2
2.18.11

Open the chart page →

1,329
okapifolio-org0.3.311 of 1See more

okapi folio-org 0.3.31

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
folioci/okapi:latestdf29ac807a45
jackson-core@2.21.5
2.21.7

Open the chart page →

48
geysergeyserVerified publisher0.1.31 of 1See more

geyser geyser 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
ghcr.io/joffreybvn/k8s-geyser:0.0.247f36880072e
jackson-core@2.18.0
2.18.11

Open the chart page →

477
opentelemetry-demogpg-dev0.33.84 of 27See more

opentelemetry-demo gpg-dev 0.33.8

4 of the 27 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
jackson-core@2.17.2
2.18.11
ghcr.io/open-telemetry/demo:1.12.0-kafka071a788162e8
jackson-core@2.17.1
2.18.11
ghcr.io/open-telemetry/demo:1.12.0-frauddetectionservice77cefdab4d5c
jackson-core@2.17.1
2.18.11
ghcr.io/open-telemetry/demo:1.12.0-adservicea59e5eead495
jackson-core@2.17.2
2.18.11

Open the chart page →

53,077
gravitino-iceberg-rest-server-helmgravitino-iceberg-rest-server1.3.111 of 1See more

gravitino-iceberg-rest-server-helm gravitino-iceberg-rest-server 1.3.11

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
apache/gravitino-iceberg-rest:1.3.080136ae753ee
jackson-core@2.18.4.1
2.18.11

Open the chart page →

5,165
grayloggraylogVerified publisher1.0.21 of 4See more

graylog graylog 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
graylog/graylog:6.1.1019de1aff48c2
jackson-core@2.17.2
2.18.11

Open the chart page →

5,525
cc-spring-appgridgainVerified publisher1.0.61 of 1See more

cc-spring-app gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
gridgain/cloud-connector:2025.5.15ab838d7d3cb
jackson-core@2.19.4
2.21.7

Open the chart page →

1,893
gridgain9gridgainVerified publisher1.1.101 of 2See more

gridgain9 gridgain 1.1.10

1 of the 2 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
gridgain/gridgain9:9.1.1895018390077b
jackson-core@2.19.2
2.21.7

Open the chart page →

3,794
guacamoleguacamole1.0.01 of 4See more

guacamole guacamole 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
jackson-core@2.19.0
2.21.7

Open the chart page →

4,512
hello-world-apihello-world-api0.0.51 of 1See more

hello-world-api hello-world-api 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
fabioformosa/hello-world-api:latest063873af085c
jackson-core@2.18.3
2.18.11

Open the chart page →

1,520
jenkinshelm-chart-for-jenkinsVerified publisher1.0.01 of 1See more

jenkins helm-chart-for-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-core@2.20.1
2.21.7

Open the chart page →

2,887
cruise-controlhelm-cruise-controlVerified publisher2.2.01 of 2See more

cruise-control helm-cruise-control 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/kafka-cruise-control:jdk17-cc2.5.146-iam2.3.90885af088157
jackson-core@2.22.1
2.22.3

Open the chart page →

1,598
alfiohelmforgeVerified publisher1.2.121 of 3See more

alfio helmforge 1.2.12

1 of the 3 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
alfio/alf.io:2.0-M5-26060c836a081446
jackson-core@2.21.2
2.21.7

Open the chart page →

2,040
archiveboxhelmforgeVerified publisher1.1.131 of 1See more

archivebox helmforge 1.1.13

1 of the 1 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.708c21bb233130
jackson-core@2.22.2
2.22.3

Open the chart page →

5,691
booklorehelmforgeVerified publisher2.0.21 of 3See more

booklore helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
jackson-core@2.21.4
2.21.7

Open the chart page →

2,116
ckanhelmforgeVerified publisher1.3.91 of 6See more

ckan helmforge 1.3.9

1 of the 6 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
jackson-core@2.18.0
2.18.11

Open the chart page →

10,398
druidhelmforgeVerified publisher1.3.61 of 4See more

druid helmforge 1.3.6

1 of the 4 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
jackson-core@2.19.2
2.21.7

Open the chart page →

8,993
elasticsearchhelmforgeVerified publisher1.1.81 of 2See more

elasticsearch helmforge 1.1.8

1 of the 2 container images this version deploys carry CVE-2026-89407.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.3a4e2b3d21ad0
jackson-core@2.18.9
2.18.11

Open the chart page →

426

Container images carrying it

493 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/fiware/tmforum-agreement:1.18.630ec0a5a9622
jackson-core@2.21.6
2.21.7
1
quay.io/fiware/tmforum-customer-bill-management:1.18.6fff6d26c5ca3
jackson-core@3.0.3
3.1.7
1
quay.io/fiware/tmforum-customer-management:1.18.650a5fd555046
jackson-core@3.0.3
3.1.7
1
quay.io/fiware/tmforum-party-catalog:1.18.6d8c5558c94ae
jackson-core@3.0.3
3.1.7
1
quay.io/fiware/tmforum-party-role:1.18.6f42cfd885f91
jackson-core@3.0.3
3.1.7
1
quay.io/fiware/tmforum-product-catalog:1.18.6af6bbdf4e818
jackson-core@3.0.3
3.1.7
1
quay.io/fiware/tmforum-product-inventory:1.18.6f138402fbdf7
jackson-core@2.21.6
2.21.7
1
quay.io/fiware/tmforum-product-ordering-management:1.18.604c1c4e9f1da
jackson-core@2.21.6
2.21.7
1
quay.io/fiware/tmforum-quote:1.18.62b4acd86144a
jackson-core@2.21.6
2.21.7
1
quay.io/fiware/tmforum-resource-catalog:1.18.68576a60e2fa4
jackson-core@3.0.3
3.1.7
1
quay.io/fiware/tmforum-resource-function-activation:1.18.670a65c2088d3
jackson-core@3.0.3
3.1.7
1
quay.io/fiware/tmforum-resource-inventory:1.18.626167d4e4999
jackson-core@2.21.6
2.21.7
1
quay.io/fiware/tmforum-resource-order-management:1.18.67400974ae09f
jackson-core@3.0.3
3.1.7
1
quay.io/fiware/tmforum-service-catalog:1.18.614925066a9c5
jackson-core@2.21.6
2.21.7
1
quay.io/fiware/tmforum-service-inventory:1.18.6a8e66f6cfdb8
jackson-core@2.21.6
2.21.7
1
quay.io/fiware/tmforum-service-order-management:1.18.6e3d04942ba85
jackson-core@2.21.6
2.21.7
1
quay.io/fiware/tmforum-software-management:1.18.620954f098e76
jackson-core@3.0.3
3.1.7
1
quay.io/fiware/tmforum-usage-management:1.18.6d5f1d688a742
jackson-core@2.21.6
2.21.7
1
quay.io/fiware/trusted-issuers-list:0.9.13c886ce5c056
jackson-core@2.19.2
2.21.7
1
quay.io/infinispan/server:16.282db6cbba3d9
jackson-core@2.22.1
2.22.3
1
quay.io/kannika/kannika-api:0.19.05e5a3b3a911e
jackson-core@3.1.5
3.1.7
1
quay.io/keycloak/keycloak:26.009a381c715ab
jackson-core@2.17.2
2.18.11
1
quay.io/keycloak/keycloak:26.60aae0de7fca8
jackson-core@2.21.2
2.21.7
1
quay.io/keycloak/keycloak:26.0.74388e2379b7e
jackson-core@2.17.2
2.18.11
1
quay.io/keycloak/keycloak:26.545ae20191531
jackson-core@2.21.2
2.21.7
1
quay.io/keycloak/keycloak:26.3.36a7217a100bd
jackson-core@2.18.2
2.18.11
1
quay.io/keycloak/keycloak:26.5.68d44614c7479
jackson-core@2.19.2
2.21.7
1
quay.io/keycloak/keycloak:26.6.39b0330756022
jackson-core@2.21.2
2.21.7
1
quay.io/keycloak/keycloak:26.0.6a93d22e13b86
jackson-core@2.17.2
2.18.11
1
quay.io/keycloak/keycloak-operator:26.0.68e3a1a56346f
jackson-core@2.17.2
2.18.11
1
quay.io/maximilianopizarro/custom-rhcl-console:dns-prober-v0.1.21a592ee6651a
jackson-core@2.21.2
2.21.7
1
quay.io/maximilianopizarro/neuralbank-backend:latesta53899fcfc01
jackson-core@2.20.0
2.21.7
1
quay.io/maximilianopizarro/openshift-integration-operator:v0.8.2d6fc43ac802e
jackson-core@2.21.4
2.21.7
1
quay.io/maximilianopizarro/showroom-docs-mcp:latest1a6eff92827a
jackson-core@2.21.2
2.21.7
1
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
jackson-core@2.19.2
2.21.7
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
jackson-core@3.1.4
3.1.7
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
jackson-core@3.1.4
3.1.7
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
jackson-core@2.17.2
2.18.11
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-core@2.22.0
2.22.3
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-core@2.19.2
2.21.7
1
quay.io/strimzi/operator:latest39cae00160b3
jackson-core@2.22.2
2.22.3
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-core@2.17.2
2.18.11
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-core@2.18.0
2.18.11
1

syft 1.42.1 · advisories as of 2 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.