StackRadarChart IndexLive demo

CVE-2026-89425

High

Advisory

Published 1 Oct 2026In the index since 2 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.005; 40th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,075; of 17,985 indexed, latest versions
Container images: 1,073; deployed by those charts
Fix available: 1 of 1; affected package

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Carried by container images the latest versions of 1,075 of 17,985 indexed charts deploy, on 1,073 images.

Affected package	Affected versions	Fixed in	Images
jackson-coremaven	2.8.1, 2.8.4, 2.8.6, 2.8.7+91 more	2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more	1,073

OSV records: GHSA-7hhh-6rmp-j9qf
Trending: Rank 3 in indexed charts, since 2 Oct 2026. See the ranking →

Charts affected

1,075 by stars

Chart

Latest

Affected images

Radar Score

keycloaksb-helm-charts

1 of 2 See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	jackson-core@2.17.2	2.18.11

Open the chart page →

2,876

keycloak-operatorschichtel

1 of 1 See more

keycloak-operator schichtel 0.8.6

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak-operator :26.7.3	3172bf49511c	jackson-core@2.21.5	2.21.7

Open the chart page →

117

photonschichtel

1 of 1 See more

photon schichtel 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
rtuszik/photon-docker :2.4.0	21549c60f9e6	jackson-core@2.22.1	2.22.3

Open the chart page →

3,650

sponge-vanillaschichtel

1 of 1 See more

sponge-vanilla schichtel 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
ghcr.io/cubeengine/sponge :1.20.2-11.0.0-RC1375	5c85f2b82064	jackson-core@2.12.3	2.18.11

Open the chart page →

1,028

smartquerysearchhub

1 of 1 See more

smartquery searchhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
commerceexperts/smartquery-service :2.2.0	9e33ad89baf6	jackson-core@2.13.5	2.18.11

Open the chart page →

1,621

smartsuggestsearchhub

1 of 1 See more

smartsuggest searchhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
commerceexperts/searchhub-smartsuggest-service :1.3.0	341eebe7239b	jackson-core@2.15.3	2.18.11

Open the chart page →

1,343

seataseata

1 of 1 See more

seata seata 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
seataio/seata-server :latest	703b5de7f1a6	jackson-core@2.13.5	2.18.11

Open the chart page →

4,766

pagessekharpkube

1 of 3 See more

pages sekharpkube 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	jackson-core@2.11.0	2.18.11

Open the chart page →

21,119

seldon-core-oauth-gatewayseldon

1 of 2 See more

seldon-core-oauth-gateway seldon 0.3.1

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
seldonio/apife :0.3.1	eea0d3f578ca	jackson-core@2.9.9	2.18.11

Open the chart page →

8,172

keycloakself-hosters-by-night

1 of 1 See more

keycloak self-hosters-by-night 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.6	0aae0de7fca8	jackson-core@2.21.2	2.21.7

Open the chart page →

689

sentry-dbsentry

1 of 10 See more

sentry-db sentry 0.9.4

1 of the 10 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :5.4.0	1bbda887bc53	jackson-core@2.9.10	2.18.11

Open the chart page →

12,043

guacamolesergiotocalini

1 of 2 See more

guacamole sergiotocalini 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
guacamole/guacamole :1.5.5	0f62f6d17ab3	jackson-core@2.17.0	2.18.11

Open the chart page →

5,883

shenyushenyu

2 of 2 See more

shenyu shenyu 0.6.3

2 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
apache/shenyu-admin :2.5.1	e2be712fc4f4	jackson-core@2.13.3	2.18.11
apache/shenyu-bootstrap :2.5.1	1bd5756f6273	jackson-core@2.13.3	2.18.11

Open the chart page →

9,092

shenyushenyu-helm-chart-test

2 of 2 See more

shenyu shenyu-helm-chart-test 2.4.27

2 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
apache/shenyu-admin :2.4.2	e8b7c4ddd069	jackson-core@2.10.1	2.18.11
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	jackson-core@2.10.1	2.18.11

Open the chart page →

12,719

showroom-docs-mcpshowroom-docs-mcp

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/showroom-docs-mcp :latest	1a6eff92827a	jackson-core@2.21.2	2.21.7

Open the chart page →

6,037

pagesshrutiujlan-pages

1 of 3 See more

pages shrutiujlan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	jackson-core@2.11.0	2.18.11

Open the chart page →

21,119

zookeepersignoz

1 of 1 See more

zookeeper signoz 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
signoz/zookeeper :3.7.1	fcc4a3288154	jackson-core@2.13.2	2.18.11

Open the chart page →

3,590

keycloaksikalabs

1 of 1 See more

keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.3.3	6a7217a100bd	jackson-core@2.18.2	2.18.11

Open the chart page →

1,941

simple-keycloaksikalabs

1 of 1 See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	jackson-core@2.13.4	2.18.11

Open the chart page →

6,686

sonatype-nexus3simcube

1 of 2 See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
sonatype/nexus3 :3.58.1	586060431b64	jackson-core@2.11.2	2.18.11

Open the chart page →

5,046

simple-apisimple-api

1 of 2 See more

simple-api simple-api 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
jkaninda/simple-api :latest	ce4122d4c789	jackson-core@2.15.4	2.18.11

Open the chart page →

1,848

sistas-chatbotsistas-chatbot

1 of 6 See more

sistas-chatbot sistas-chatbot 5.0.2

1 of the 6 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
jhipster/jhipster-registry :latest	7184525acd4d	jackson-core@2.13.3	2.18.11

Open the chart page →

6,230

digdagskyoo2003

1 of 4 See more

digdag skyoo2003 0.5.2

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
ghcr.io/skyoo2003/digdag :0.0.1	821fd6a6f2cd	jackson-core@2.9.10	2.18.11

Open the chart page →

7,025

hetzner-iroboslamdev

1 of 1 See more

hetzner-irobo slamdev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
slamdev/hetzner-irobo :0.0.1	3ca20c184c55	jackson-core@2.12.5	2.18.11

Open the chart page →

3,835

bootzookasoftwaremill

1 of 2 See more

bootzooka softwaremill 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
softwaremill/bootzooka :latest	845b5e8f8056	jackson-core@3.1.1	3.1.7

Open the chart page →

3,727

stewardsoftwaremill

1 of 1 See more

steward softwaremill 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
fthomas/scala-steward :latest	a8eb43927576	jackson-core@2.12.7	2.18.11

Open the chart page →

623

keycloak-operatorsomaz94

1 of 1 See more

keycloak-operator somaz94 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak-operator :26.7.4	06a13deb3919	jackson-core@2.21.5	2.21.7

Open the chart page →

117

atlassian-confluencesomeblackmagic

1 of 1 See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
atlassian/confluence-server :7.10.0	3b9222ab32ef	jackson-core@2.10.0	2.18.11

Open the chart page →

14,184

atlassian-jirasomeblackmagic

1 of 1 See more

atlassian-jira someblackmagic 3.3.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
atlassian/jira-software :8.14.0	37bc46cbec1a	jackson-core@2.10.2	2.18.11

Open the chart page →

13,553

smtp-fake-serversomeblackmagic

1 of 1 See more

smtp-fake-server someblackmagic 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
someblackmagic/smtp-fake-server :latest	0d63ba37a560	jackson-core@2.11.3	2.18.11

Open the chart page →

4,962

languagetoolsomeone-stole-my-name

1 of 1 See more

languagetool someone-stole-my-name 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
ghcr.io/someone-stole-my-name/docker-languagetool :6.0	d411e4365eef	jackson-core@2.13.4	2.18.11

Open the chart page →

1,644

strimzi-user-operatorspartan

1 of 1 See more

strimzi-user-operator spartan 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
quay.io/strimzi/operator :0.45.1	58c727cd2e68	jackson-core@2.16.2	2.18.11

Open the chart page →

2,112

spring-boot-helm-starterspring-boot-helm-starter

1 of 1 See more

spring-boot-helm-starter spring-boot-helm-starter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
alexandreroman/hello :latest	4b79473442be	jackson-core@2.9.8	2.18.11

Open the chart page →

119,837

pagessrinipages

1 of 3 See more

pages srinipages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	jackson-core@2.11.0	2.18.11

Open the chart page →

21,119

newrelic-private-minionsstarcher

1 of 1 See more

newrelic-private-minion sstarcher 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
quay.io/newrelic/synthetics-minion :2.2.21	98c26e1b8f70	jackson-core@2.10.1	2.18.11

Open the chart page →

3,239

retail-store-sample-cart-chartstacksimplify

1 of 1 See more

retail-store-sample-cart-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-containers/retail-store-sample-cart :1.3.0	5d767569c976	jackson-core@2.19.2	2.21.7

Open the chart page →

1,218

retail-store-sample-orders-chartstacksimplify

1 of 1 See more

retail-store-sample-orders-chart stacksimplify 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-containers/retail-store-sample-orders :1.3.0	e85f034bcf48	jackson-core@2.19.2	2.21.7

Open the chart page →

1,406

retail-store-sample-ui-chartstacksimplify

1 of 1 See more

retail-store-sample-ui-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-containers/retail-store-sample-ui :1.3.0	ce3f2e935eb3	jackson-core@2.19.2	2.21.7

Open the chart page →

995

umsappstacksimplify

1 of 3 See more

umsapp stacksimplify 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
ghcr.io/stacksimplify/kube-usermgmt-webapp :1.0.0-mysqldb	41b45003c6b6	jackson-core@2.9.9	2.18.11

Open the chart page →

6,134

cerebrostakater

1 of 2 See more

cerebro stakater 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
lmenezes/cerebro :0.8.1	3e860068e403	jackson-core@2.8.11	2.18.11

Open the chart page →

2,991

hazelcaststakater

1 of 1 See more

hazelcast stakater 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
hazelcast/hazelcast :latest	f086bf0ecb23	jackson-core@2.21.2	2.21.7

Open the chart page →

1,880

jenkinsstakater

1 of 1 See more

jenkins stakater 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	c1e4c349365f	jackson-core@2.20.1	2.21.7

Open the chart page →

3,140

nordmart-reviewstakater

1 of 3 See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
stakater/stakater-nordmart-review :1.0.35	954d2be66e95	jackson-core@2.13.3	2.18.11

Open the chart page →

12,554

nordmart-review-instancestakater

1 of 3 See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
stakater/stakater-nordmart-review :1.0.35	954d2be66e95	jackson-core@2.13.3	2.18.11

Open the chart page →

12,554

sonarqubestakater

1 of 2 See more

sonarqube stakater 0.10.3

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
library/sonarqube :6.7.6-community	0ae5169e3d0f	jackson-core@2.9.5	2.18.11

Open the chart page →

13,446

teku-validatorstakewise

1 of 2 See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
consensys/teku :25.4.1	bf6ecd2ea716	jackson-core@2.18.3	2.18.11

Open the chart page →

3,592

unifistartechnica

1 of 2 See more

unifi startechnica 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
jacobalberty/unifi :v7.1.66	4a3616625dda	jackson-core@2.13.1	2.18.11

Open the chart page →

15,977

fdi-dotstatsuite-sfs-solrstatcan

1 of 4 See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
library/solr :8.11.1	8c5f7881cebb	jackson-core@2.12.3	2.18.11

Open the chart page →

6,909

solrstatcan

2 of 3 See more

solr statcan 1.5.10

2 of the 3 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
library/solr :8.11.1	8c5f7881cebb	jackson-core@2.12.3	2.18.11
library/zookeeper :3.5.5	b7a76ec06f68	jackson-core@2.9.8	2.18.11

Open the chart page →

10,006

trinostatcan

1 of 2 See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container image	Digest	Package	Fixed in
trinodb/trino :405	ee80ab5eeab2	jackson-core@2.13.2	2.18.11

Open the chart page →

14,472

Container images carrying it

1,073 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/maximilianopizarro/neuralbank-backend :latest	a53899fcfc01	jackson-core@2.20.0	2.21.7	1
quay.io/maximilianopizarro/openshift-integration-operator :v0.8.2	d6fc43ac802e	jackson-core@2.21.4	2.21.7	1
quay.io/maximilianopizarro/showroom-docs-mcp :latest	1a6eff92827a	jackson-core@2.21.2	2.21.7	1
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	jackson-core@2.15.3	2.18.11	1
quay.io/microcks/microcks-operator :0.0.11	96d1054d4a61	jackson-core@2.19.2	2.21.7	1
quay.io/newrelic/synthetics-minion :2.2.21	98c26e1b8f70	jackson-core@2.10.1	2.18.11	1
quay.io/opsmxpublic/ubi8-gate :isd-spin-2025.10.01-5c720954-202511260810	2b3554029737	jackson-core@2.14.1	2.18.11	1
quay.io/opsmxpublic/ubi8-oes-audit-client :isd-spin-2025.10.01-cb1bfce-202511261037	32a5b1887eab	jackson-core@2.15.3	2.18.11	1
quay.io/opsmxpublic/ubi8-oes-autopilot :isd-spin-2025.10.01-af26a30d4-202511261054	58bd0bcf72f9	jackson-core@2.15.3	2.18.11	1
quay.io/opsmxpublic/ubi8-oes-platform :isd-spin-2025.10.01-a7c191ec-202511261122	8ed603ab7417	jackson-core@2.15.3	2.18.11	1
quay.io/poundex/tekton-ci-environment-injector :0.2.4	6dd65f22949c	jackson-core@3.1.4	3.1.7	1
quay.io/poundex/tekton-stash-and-cache :0.2.2	e854423caa09	jackson-core@3.1.4	3.1.7	1
quay.io/seamware/consent-facade :0.0.14	be844c750c7e	jackson-core@2.17.2	2.18.11	1
quay.io/snowdrop/spring-boot-rest-http-example :2.7	b1a054613715	jackson-core@2.13.5	2.18.11	1
quay.io/srcmaxim/gradle-example-app :1.1.3	7c3fc28746ef	jackson-core@2.12.3	2.18.11	1
quay.io/sshaaf/keycloak-mcp-server :0.4.0	b7e9cba72f8a	jackson-core@2.22.0	2.22.3	1
quay.io/streamshub/console-operator :0.11.0	e40bbfeae125	jackson-core@2.19.2	2.21.7	1
quay.io/strimzi/operator :latest	39cae00160b3	jackson-core@2.22.2	2.22.3	1
quay.io/strimzi/operator :0.45.1	58c727cd2e68	jackson-core@2.16.2	2.18.11	1
quay.io/strimzi/operator :0.32.0	c5e0e5dca750	jackson-core@2.13.4	2.18.11	1
quay.io/strimzi/operator :0.36.1	e9e03b31007c	jackson-core@2.14.2	2.18.11	1
quay.io/wi_stefan/dss-validation-service :0.0.1	8e928db29ee1	jackson-core@2.17.2	2.18.11	1
registry.gitlab.com/dyff/workflows-aggregator :0.16.11	26450354eba9	jackson-core@2.18.0	2.18.11	1