StackRadar

CVE-2026-89425

High

Advisory

Published 1 Oct 2026In the index since 2 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,075
of 17,985 indexed, latest versions
Container images
1,073
deployed by those charts
Fix available
1 of 1
affected package

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Carried by container images the latest versions of 1,075 of 17,985 indexed charts deploy, on 1,073 images.

Affected packageAffected versionsFixed inImages
jackson-coremaven2.8.1, 2.8.4, 2.8.6, 2.8.7+91 more2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more1,073
OSV records
GHSA-7hhh-6rmp-j9qf
Trending
Rank 3 in indexed charts, since 2 Oct 2026. See the ranking →

Charts affected

1,075 by stars
ChartLatestAffected imagesRadar Score
lakehouse-stackquench-lakehouse-stackVerified publisher0.0.72 of 4See more

lakehouse-stack quench-lakehouse-stack 0.0.7

2 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/nessiedigest-pinned5aa4f4387418
jackson-core@2.22.2
2.22.3
ghcr.io/quenchworks/images/trinodigest-pinned9b3f2f1d90ac
jackson-core@2.22.1
2.22.3

Open the chart page →

192
metabasequench-metabaseVerified publisher0.0.41 of 2See more

metabase quench-metabase 0.0.4

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/metabasedigest-pinnedf49a0440219e
jackson-core@2.21.6
2.21.7

Open the chart page →

164
neo4jquench-neo4jVerified publisher0.0.191 of 1See more

neo4j quench-neo4j 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/neo4jdigest-pinned7b18b33e3b67
jackson-core@2.22.2
2.22.3

Open the chart page →

74
nessiequench-nessieVerified publisher0.0.21 of 1See more

nessie quench-nessie 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/nessiedigest-pinned5aa4f4387418
jackson-core@2.22.2
2.22.3

Open the chart page →

74
nifiquench-nifiVerified publisher0.0.41 of 1See more

nifi quench-nifi 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/nifidigest-pinnedd3d08bc84eb6
jackson-core@2.22.2
2.22.3

Open the chart page →

99
opensearchquench-opensearchVerified publisher0.1.111 of 1See more

opensearch quench-opensearch 0.1.11

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/opensearchdigest-pinned37679c4e06cb
jackson-core@2.22.1
2.22.3

Open the chart page →

74
secrets-stackquench-secrets-stackVerified publisher0.0.71 of 3See more

secrets-stack quench-secrets-stack 0.0.7

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/keycloakdigest-pinned6d08670cfdb6
jackson-core@2.21.5
2.21.7

Open the chart page →

230
solrquench-solrVerified publisher0.0.191 of 1See more

solr quench-solr 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/solrdigest-pinned6e85f046a560
jackson-core@2.21.5
2.21.7

Open the chart page →

99
streaming-stackquench-streaming-stackVerified publisher0.0.62 of 3See more

streaming-stack quench-streaming-stack 0.0.6

2 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/akhqdigest-pinned0cad184c33c4
jackson-core@3.1.5
3.1.7
ghcr.io/quenchworks/images/kafkadigest-pinned9e25982c27b9
jackson-core@2.21.5
2.21.7

Open the chart page →

260
trinoquench-trinoVerified publisher0.0.61 of 1See more

trino quench-trino 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/trinodigest-pinned9b3f2f1d90ac
jackson-core@2.22.1
2.22.3

Open the chart page →

74
wildflyquench-wildflyVerified publisher0.0.51 of 1See more

wildfly quench-wildfly 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/wildflydigest-pinned240be2a4d1bf
jackson-core@2.21.5
2.21.7

Open the chart page →

80
zipkinquench-zipkinVerified publisher0.0.41 of 1See more

zipkin quench-zipkin 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/zipkindigest-pinned74533b6afbf1
jackson-core@2.21.5
2.21.7

Open the chart page →

74
zookeeperquench-zookeeperVerified publisher0.0.181 of 1See more

zookeeper quench-zookeeper 0.0.18

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/zookeeperdigest-pinned033e2ba0ad94
jackson-core@2.22.2
2.22.3

Open the chart page →

74
rada-platformrada-platform0.1.02 of 7See more

rada-platform rada-platform 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
jackson-core@2.17.1
2.18.11
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
jackson-core@2.17.2
2.18.11

Open the chart page →

23,488
app-configradar-baseVerified publisher1.7.21 of 1See more

app-config radar-base 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-app-config/radar-app-config:0.6.24431db7b486b
jackson-core@2.14.2
2.18.11

Open the chart page →

2,404
catalog-serverradar-baseVerified publisher0.9.31 of 1See more

catalog-server radar-base 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-schemas/radar-schemas-tools:0.8.16c442e8bfe6b4
jackson-core@2.20.2
2.21.7

Open the chart page →

2,792
data-dashboard-backendradar-baseVerified publisher0.6.21 of 1See more

data-dashboard-backend radar-base 0.6.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-data-dashboard-backend/radar-data-dashboard-backend:0.2.4d1e55350923c
jackson-core@2.20.2
2.21.7

Open the chart page →

2,387
management-portalradar-baseVerified publisher1.7.01 of 1See more

management-portal radar-base 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
jackson-core@2.16.1
2.18.11

Open the chart page →

3,733
mockserverradar-baseVerified publisher5.15.01 of 1See more

mockserver radar-base 5.15.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
mockserver/mockserver:mockserver-5.15.00f9ef78c9489
jackson-core@2.14.1
2.18.11

Open the chart page →

1,527
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
jackson-core@2.14.2
2.18.11

Open the chart page →

6,018
radar-gatewayradar-baseVerified publisher1.9.01 of 2See more

radar-gateway radar-base 1.9.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
jackson-core@2.20.2
2.21.7

Open the chart page →

2,674
radar-integrationradar-baseVerified publisher0.9.01 of 1See more

radar-integration radar-base 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
radarbase/radar-redcapintegration:1.0.6fcd973d4796d
jackson-core@2.16.1
2.18.11

Open the chart page →

3,223
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jackson-core@2.18.3
2.18.11

Open the chart page →

5,009
radar-mockserverradar-baseVerified publisher0.1.31 of 1See more

radar-mockserver radar-base 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
mockserver/mockserver:mockserver-5.15.00f9ef78c9489
jackson-core@2.14.1
2.18.11

Open the chart page →

1,527
radar-outputradar-baseVerified publisher1.2.101 of 1See more

radar-output radar-base 1.2.10

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
jackson-core@2.20.2
2.21.7

Open the chart page →

2,890
radar-push-endpointradar-baseVerified publisher0.6.81 of 2See more

radar-push-endpoint radar-base 0.6.8

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
radarbase/radar-push-endpoint:0.4.0e1758508e033
jackson-core@2.16.1
2.18.11

Open the chart page →

3,389
radar-upload-connect-backendradar-baseVerified publisher0.9.11 of 1See more

radar-upload-connect-backend radar-base 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-backend:0.6.46a04b43b8d9a
jackson-core@2.19.2
2.21.7

Open the chart page →

2,914
strimzi-kafka-operatorradar-baseVerified publisher0.46.01 of 1See more

strimzi-kafka-operator radar-base 0.46.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jackson-core@2.18.3
2.18.11

Open the chart page →

2,212
pagesranjinigogga1.0.01 of 3See more

pages ranjinigogga 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
pagesrebecca-pages1.0.01 of 3See more

pages rebecca-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
authentication-serviceredestroyder0.2.21 of 1See more

authentication-service redestroyder 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
redestroyder/authorization-service:0.0.1740364a619fd
jackson-core@2.13.1
2.18.11

Open the chart page →

2,710
business-serviceredestroyder0.2.11 of 1See more

business-service redestroyder 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
redestroyder/business-service:0.0.1db03499a0726
jackson-core@2.13.1
2.18.11

Open the chart page →

2,732
iparedhat-cop1.3.91 of 1See more

ipa redhat-cop 1.3.9

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/freeipa/freeipa-server:fedora-39-4.11.1d422ee50c2c3
jackson-core@2.15.2
2.18.11

Open the chart page →

1,080
sonarquberedhat-cop0.1.131 of 1See more

sonarqube redhat-cop 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
library/sonarqube:10.7.0-community0842dcd4c8f8
jackson-core@2.17.1
2.18.11

Open the chart page →

4,708
reportportalreportportal5.7.23 of 8See more

reportportal reportportal 5.7.2

3 of the 8 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
reportportal/service-api:5.7.29df41f8fb320
jackson-core@2.10.2
2.18.11
reportportal/service-authorization:5.7.09e73114dbd15
jackson-core@2.10.2
2.18.11
reportportal/service-jobs:5.7.2dc166c58485a
jackson-core@2.11.4
2.18.11

Open the chart page →

28,813
pagesroccohiggins-pages1.0.01 of 3See more

pages roccohiggins-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
pagesronan-pages1.0.01 of 3See more

pages ronan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
routr-connectroutr0.4.32 of 10See more

routr-connect routr 0.4.3

2 of the 10 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
fonoster/routr-edgeport:2.13.6d08a8a574a50
jackson-core@2.9.6
2.18.11
fonoster/routr-requester:2.13.6e0c823506eb2
jackson-core@2.9.6
2.18.11

Open the chart page →

12,135
komgarubxkubeVerified publisher0.1.51 of 1See more

komga rubxkube 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
gotson/komga:1.28.1d8f772dce7b3
jackson-core@2.21.4
2.21.7

Open the chart page →

34,125
languagetoolrubxkubeVerified publisher0.1.01 of 1See more

languagetool rubxkube 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
meyay/languagetool:6.8410a1f1a893b
jackson-core@2.22.2
2.22.3

Open the chart page →

67
stirling-pdfrubxkubeVerified publisher0.1.21 of 1See more

stirling-pdf rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
jackson-core@2.21.2
2.21.7

Open the chart page →

7,150
suwayomirubxkubeVerified publisher0.1.21 of 1See more

suwayomi rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/suwayomi/suwayomi-server:v2.3.2320d2c3218c7f9f
jackson-core@2.22.0
2.22.3

Open the chart page →

2,041
housekeepersaashousekeeper1.0.01 of 14See more

housekeeper saashousekeeper 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
saashousekeeper/event-tracking:1.0.0d8786cea5bc4
jackson-core@2.13.2
2.18.11

Open the chart page →

4,706
nacossaber0.1.111 of 1See more

nacos saber 0.1.11

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
nacos/nacos-server:v2.1.0dcf04549c6d7
jackson-core@2.12.2
2.18.11

Open the chart page →

4,086
fmtok8s-conference-chartsalaboy0.1.41 of 6See more

fmtok8s-conference-chart salaboy 0.1.4

1 of the 6 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-frontend:v0.1.103fd01b4f56e
jackson-core@2.13.3
2.18.11

Open the chart page →

18,722
fmtok8s-frontendsalaboy0.1.31 of 1See more

fmtok8s-frontend salaboy 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-frontend:v0.1.103fd01b4f56e
jackson-core@2.13.3
2.18.11

Open the chart page →

8,537
helm-chart-examplesalaboy0.1.01 of 1See more

helm-chart-example salaboy 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
salaboy/fmtok8s-monolith:v0.1.0f225568e6d03
jackson-core@2.11.1
2.18.11

Open the chart page →

3,295
pagessamanvithkaranth1.0.01 of 3See more

pages samanvithkaranth 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
pagessarubits-pages1.0.01 of 3See more

pages sarubits-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
kafkasb-helm-charts0.3.01 of 2See more

kafka sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
provectuslabs/kafka-ui:latest8f2ff02d64b0
jackson-core@2.15.2
2.18.11

Open the chart page →

1,732

Container images carrying it

1,073 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/maximilianopizarro/neuralbank-backend:latesta53899fcfc01
jackson-core@2.20.0
2.21.7
1
quay.io/maximilianopizarro/openshift-integration-operator:v0.8.2d6fc43ac802e
jackson-core@2.21.4
2.21.7
1
quay.io/maximilianopizarro/showroom-docs-mcp:latest1a6eff92827a
jackson-core@2.21.2
2.21.7
1
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
jackson-core@2.15.3
2.18.11
1
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
jackson-core@2.19.2
2.21.7
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
jackson-core@2.10.1
2.18.11
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
jackson-core@2.14.1
2.18.11
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
jackson-core@2.15.3
2.18.11
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
jackson-core@2.15.3
2.18.11
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
jackson-core@2.15.3
2.18.11
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
jackson-core@3.1.4
3.1.7
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
jackson-core@3.1.4
3.1.7
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
jackson-core@2.17.2
2.18.11
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
jackson-core@2.13.5
2.18.11
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
jackson-core@2.12.3
2.18.11
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-core@2.22.0
2.22.3
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-core@2.19.2
2.21.7
1
quay.io/strimzi/operator:latest39cae00160b3
jackson-core@2.22.2
2.22.3
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-core@2.16.2
2.18.11
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-core@2.13.4
2.18.11
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-core@2.14.2
2.18.11
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-core@2.17.2
2.18.11
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-core@2.18.0
2.18.11
1

syft 1.42.1 · advisories as of 3 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.