StackRadar

CVE-2026-89425

High

Advisory

Published 1 Oct 2026In the index since 2 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,076
of 17,985 indexed, latest versions
Container images
1,074
deployed by those charts
Fix available
1 of 1
affected package

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Carried by container images the latest versions of 1,076 of 17,985 indexed charts deploy, on 1,074 images.

Affected packageAffected versionsFixed inImages
jackson-coremaven2.8.1, 2.8.4, 2.8.6, 2.8.7+91 more2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more1,074
OSV records
GHSA-7hhh-6rmp-j9qf
Trending
Rank 30 in indexed charts, since 2 Oct 2026. See the ranking →

Charts affected

1,076 by stars
ChartLatestAffected imagesRadar Score
alluremidokura-communityVerified publisher0.1.31 of 2See more

allure midokura-community 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.19.0cafa03b94dac
jackson-core@2.13.3
2.18.11

Open the chart page →

72,855
unifimidokura-communityVerified publisher0.0.61 of 1See more

unifi midokura-community 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
linuxserver/unifi-controller:7.3.83ab105cc50322
jackson-core@2.13.1
2.18.11

Open the chart page →

11,816
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
jackson-core@2.9.5
2.18.11

Open the chart page →

15,953
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
mintproject/model-catalog-endpoint:29256555a6fbaefae4729d5cd259564708a4ab04ffbb13f20465
jackson-core@2.9.6
2.18.11

Open the chart page →

116,845
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
opensearchproject/opensearch:1.1.0967d7f57f72f
jackson-core@2.11.4
2.18.11

Open the chart page →

11,286
standard-application-stackmintel11.5.01 of 12See more

standard-application-stack mintel 11.5.0

1 of the 12 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
opensearchproject/opensearch:1.1.0967d7f57f72f
jackson-core@2.11.4
2.18.11

Open the chart page →

10,827
mitre-siphonmitre-siphon0.2.91 of 4See more

mitre-siphon mitre-siphon 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/mitre-siphon:main503c00321502
jackson-core@2.14.3
2.18.11

Open the chart page →

3,210
verapdfmlohrVerified publisher1.4.01 of 1See more

verapdf mlohr 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
verapdf/rest:v1.30.2341359ac6af5
jackson-core@2.21.1
2.21.7

Open the chart page →

604
account-lookup-servicemojaloop13.0.01 of 4See more

account-lookup-service mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
jackson-core@2.13.3
2.18.11

Open the chart page →

12,398
account-lookup-service-adminmojaloop13.0.01 of 4See more

account-lookup-service-admin mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
jackson-core@2.13.3
2.18.11

Open the chart page →

12,398
admin-api-svcmojaloop12.0.01 of 4See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
jackson-core@2.13.3
2.18.11

Open the chart page →

12,820
backendmojaloop0.1.02 of 6See more

backend mojaloop 0.1.0

2 of the 6 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
bitnamilegacy/kafka:2.8.1-debian-11-r7b6e381ffd6ae
jackson-core@2.10.5
2.18.11
bitnamilegacy/zookeeper:3.7.2-debian-11-r5cbf54314c401
jackson-core@2.15.2
2.18.11

Open the chart page →

16,817
fspiop-transfer-api-svcmojaloop12.0.11 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
jackson-core@2.13.3
2.18.11

Open the chart page →

12,141
mojaloopmojaloop14.0.01 of 6See more

mojaloop mojaloop 14.0.0

1 of the 6 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
jackson-core@2.13.3
2.18.11

Open the chart page →

20,159
user-manager-neo4jmoreillonVerified publisher0.9.71 of 6See more

user-manager-neo4j moreillon 0.9.7

1 of the 6 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
library/neo4j:5.20.052d3dec8d455
jackson-core@2.17.0
2.18.11

Open the chart page →

32,517
chirpstackmosquitto-helm-chart0.5.01 of 8See more

chirpstack mosquitto-helm-chart 0.5.0

1 of the 8 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.9.0d056c89b7131
jackson-core@2.12.3
2.18.11

Open the chart page →

103,145
pulsarmosquitto-helm-chart0.2.01 of 1See more

pulsar mosquitto-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.10.03b262ab7a7d9
jackson-core@2.12.6
2.18.11

Open the chart page →

16,515
crowdmoxVerified publisher2.4.31 of 3See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
atlassian/crowd:5.2.2708162b8c094
jackson-core@2.13.4
2.18.11

Open the chart page →

5,893
commafeedmt1905028.2.01 of 3See more

commafeed mt190502 8.2.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
athou/commafeed:6.2.0-postgresql5e388351df1a
jackson-core@2.20.1
2.21.7

Open the chart page →

3,958
keycloakmt1905021.4.61 of 3See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.5.68d44614c7479
jackson-core@2.19.2
2.21.7

Open the chart page →

2,964
devops-demomungari-development-charts1.0.41 of 4See more

devops-demo mungari-development-charts 1.0.4

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
jackson-core@2.13.4
2.18.11

Open the chart page →

9,053
pagesmuthu-pages1.0.01 of 3See more

pages muthu-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

20,800
myappmyapp-helm-charts0.4.01 of 1See more

myapp myapp-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
adityaprasadpathak/myapp:3.07e3b9777362c
jackson-core@2.17.1
2.18.11

Open the chart page →

2,264
my-app-namemy-app-name0.0.21 of 1See more

my-app-name my-app-name 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
viniciusfcf/gitops-quarkus-app-jvm:latestbba8ee1b5cd5
jackson-core@2.13.3
2.18.11

Open the chart page →

9,626
elasticsearch-chartmy-elasticsearch0.1.01 of 2See more

elasticsearch-chart my-elasticsearch 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.35e6ac15bf6a5
jackson-core@2.10.4
2.18.11

Open the chart page →

9,699
Practica_4_helmmy-heml-appVerified publisher0.1.03 of 7See more

Practica_4_helm my-heml-app 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
adagber/planner:v1.0e5c1ed097752
jackson-core@2.13.0
2.18.11
codeurjc/server:v1.0310bea5b1ee7
jackson-core@2.13.4
2.18.11
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-core@2.14.1
2.18.11

Open the chart page →

29,109
nacosnacos-yunyeVerified publisher1.0.31 of 1See more

nacos nacos-yunye 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.130a39cb0c54d
jackson-core@2.18.3
2.18.11

Open the chart page →

2,189
dependency-tracknaj980.0.91 of 3See more

dependency-track naj98 0.0.9

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dependencytrack/apiserver:latest9008fc010a21
jackson-core@2.22.0
2.22.3

Open the chart page →

1,905
pagesnarain1.0.01 of 3See more

pages narain 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

20,800
pagesnarasimha-pages1.0.01 of 3See more

pages narasimha-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

20,800
pagesnavin-brixton1.0.01 of 3See more

pages navin-brixton 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

20,800
elasticsearch2ncsaVerified publisher0.2.21 of 2See more

elasticsearch2 ncsa 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
library/elasticsearch:2.4.641ed3a1a16b6
jackson-core@2.8.1
2.18.11

Open the chart page →

4,965
incorencsaVerified publisher1.38.01 of 29See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
bitnamilegacy/keycloak:24.0.4cc599cbd15ff
jackson-core@2.16.1
2.18.11

Open the chart page →

16,233
polyglotncsaVerified publisher0.1.11 of 18See more

polyglot ncsa 0.1.1

1 of the 18 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
craigwillis/c2metadata-bd:latestae317d7e4724
jackson-core@2.9.8
2.18.11

Open the chart page →

55,485
neo4jneo4j-helm-old4.3.2-11 of 1See more

neo4j neo4j-helm-old 4.3.2-1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
library/neo4j:4.3.2-enterprise56a9453c4064
jackson-core@2.12.1
2.18.11

Open the chart page →

2,737
ma1sdnetsocVerified publisher0.2.11 of 1See more

ma1sd netsoc 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ma1uta/ma1sd:2.5.0ee2a56d8b8ca
jackson-core@2.9.9
2.18.11

Open the chart page →

3,629
neuralbank-stackneuralbank-stack0.1.01 of 4See more

neuralbank-stack neuralbank-stack 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuralbank-backend:latesta53899fcfc01
jackson-core@2.20.0
2.21.7

Open the chart page →

5,639
davosnicholaswildeVerified publisher1.0.01 of 1See more

davos nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/davos:2.2.1-ls7624ba55aeaa4f
jackson-core@2.8.4
2.18.11

Open the chart page →

6,636
config-server-helm-chartnotesprojectchart0.1.01 of 1See more

config-server-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
vlebediantsev/config-server-another:lateste7f20450d2ae
jackson-core@2.13.3
2.18.11

Open the chart page →

3,496
file-system-ms-helm-chartnotesprojectchart0.1.01 of 2See more

file-system-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
vlebediantsev/file-system-ms-final:latest10393a89b4a8
jackson-core@2.13.3
2.18.11

Open the chart page →

5,816
kafka-helm-chartnotesprojectchart0.1.01 of 1See more

kafka-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-core@2.10.5
2.18.11

Open the chart page →

4,683
logic-ms-helm-chartnotesprojectchart0.1.01 of 2See more

logic-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
vlebediantsev/logic-ms:latestdf8bf38c535b
jackson-core@2.13.3
2.18.11

Open the chart page →

6,832
registration-ms-helm-chartnotesprojectchart0.1.01 of 2See more

registration-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-final:latest427af418b75e
jackson-core@2.13.3
2.18.11

Open the chart page →

5,839
user-data-ms-helm-chartnotesprojectchart0.1.01 of 2See more

user-data-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
jackson-core@2.13.3
2.18.11

Open the chart page →

5,796
dependency-tracknovum-rgi-charts0.1.81 of 2See more

dependency-track novum-rgi-charts 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
owasp/dependency-track:3.8.0efc65e702ee1
jackson-core@2.10.3
2.18.11

Open the chart page →

3,712
nexus2novum-rgi-charts0.1.11 of 1See more

nexus2 novum-rgi-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
sonatype/nexus:oss6bc88b51d4d7
jackson-core@2.11.3
2.18.11

Open the chart page →

3,357
olvid-botobeoneVerified publisher0.3.31 of 1See more

olvid-bot obeone 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
olvid/bot-daemon:2.0.1e0e6b165d879
jackson-core@2.15.2
2.18.11

Open the chart page →

2,377
my-bloody-jenkinsodavid0.1.2181 of 1See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
jackson-core@2.17.2
2.18.11

Open the chart page →

6,103
hive-metastoreolehrgfVerified publisher0.1.01 of 1See more

hive-metastore olehrgf 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
jackson-core@2.13.0
2.18.11

Open the chart page →

8,667
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
jackson-core@2.14.2
2.18.11

Open the chart page →

9,957

Container images carrying it

1,074 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/tika:2.9.0.092d055a84e9e
jackson-core@2.15.2
2.18.11
2
apache/tika:2.9.2.1-fullae0b86d3c4d0
jackson-core@2.17.0
2.18.11
2
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
jackson-core@2.17.2
2.18.11
2
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
jackson-core@2.15.2
2.18.11
2
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
jackson-core@2.14.2
2.18.11
2
confluentinc/cp-zookeeper:latest7610a50b13e7
jackson-core@2.16.0
2.18.11
2
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
jackson-core@2.13.4
2.18.11
2
datagrok/grok_connect:latestf5876d3aebb8
jackson-core@2.21.5
2.21.7
2
dependencytrack/apiserver:4.6.3485ac0952c02
jackson-core@2.13.4
2.18.11
2
dina1993/airports-api:latestac731244aed1
jackson-core@2.14.2
2.18.11
2
dina1993/airports-consumer:latest669d146a5e63
jackson-core@2.14.2
2.18.11
2
dina1993/airports-producer:latest3d6b0dac1cb4
jackson-core@2.14.2
2.18.11
2
dzikoysk/reposilite:3.6.390de4c8e6c0e
jackson-core@2.22.2
2.22.3
2
empathyco/elasticsearch:6.6.2-memlockbcf4365ee7ec
jackson-core@2.8.11
2.18.11
2
frinx/sample-topology:6.1.01a19658415b6
jackson-core@2.15.4
2.18.11
2
geoservercloud/geoserver-cloud-gateway:1.0-RC3756559ee788a
jackson-core@2.11.2
2.18.11
2
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
jackson-core@2.11.2
2.18.11
2
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
jackson-core@2.11.2
2.18.11
2
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
jackson-core@2.11.2
2.18.11
2
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
jackson-core@2.11.2
2.18.11
2
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
jackson-core@2.11.2
2.18.11
2
gisaia/arlas-permissions-server:28.0.0e612fc722e02
jackson-core@2.21.1
2.21.7
2
gisaia/arlas-persistence-server:28.0.0f667e0ee79be
jackson-core@2.19.2
2.21.7
2
gisaia/arlas-server:28.0.04e693e7b6f37
jackson-core@2.21.1
2.21.7
2
gradiant/opentsdb:2.4.0c33d53913869
jackson-core@2.9.5
2.18.11
2
graviteeio/apim-gateway:4.12.20-debian8f1a14449381
jackson-core@2.21.2
2.21.7
2
graviteeio/apim-management-api:4.12.20-debiand30d085395ca
jackson-core@2.21.2
2.21.7
2
hazelcast/management-center:5.5.29241de019fc7
jackson-core@2.17.2
2.18.11
2
hookiesolutions/webhookie:latest0629694246ba
jackson-core@2.13.1
2.18.11
2
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
jackson-core@2.13.2
2.18.11
2
inaccel/coral:2.18c53744ed70b
jackson-core@2.13.5
2.18.11
2
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
jackson-core@2.15.2
2.18.11
2
jenkins/jenkins:2.541.3-jdk21c4098086090c
jackson-core@2.18.0
2.18.11
2
library/cassandra:4.1.37cbcec0086ac
jackson-core@2.13.2
2.18.11
2
library/elasticsearch:2.4.641ed3a1a16b6
jackson-core@2.8.1
2.18.11
2
library/elasticsearch:7.17.35e6ac15bf6a5
jackson-core@2.10.4
2.18.11
2
library/elasticsearch:8.19.22d071f96fab6c
jackson-core@2.21.6
2.21.7
2
library/neo4j:5.20.052d3dec8d455
jackson-core@2.17.0
2.18.11
2
library/neo4j:4.3.2-enterprise56a9453c4064
jackson-core@2.12.1
2.18.11
2
linuxserver/ubooquity:2.1.2-ls369932d6759112
jackson-core@2.8.4
2.18.11
2
mbentley/omada-controller:4.3f4e682274bed
jackson-core@2.9.8
2.18.11
2
metabase/metabase:v0.45.21fb334ce4820
jackson-core@2.13.4
2.18.11
2
metabase/metabase:v0.61.1.x9491ed11c901
jackson-core@2.21.2
2.21.7
2
nacos/nacos-server:latest1c191c30c8cd
jackson-core@2.21.2
2.21.7
2
nacos/nacos-server:v2.1.0dcf04549c6d7
jackson-core@2.12.2
2.18.11
2
nacos/nacos-server:1.4.1fe6e5688cdf3
jackson-core@2.10.4
2.18.11
2
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
jackson-core@2.13.2
2.18.11
2
opensearchproject/opensearch:2.1.04254021a8c71
jackson-core@2.12.6
2.18.11
2
opensearchproject/opensearch:2.18.07f6fa1efee8f
jackson-core@2.17.2
2.18.11
2
opensearchproject/opensearch:1.1.0967d7f57f72f
jackson-core@2.11.4
2.18.11
2

syft 1.42.1 · advisories as of 2 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.