StackRadar

CVE-2026-89425

High

Advisory

Published 1 Oct 2026In the index since 2 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,075
of 17,985 indexed, latest versions
Container images
1,073
deployed by those charts
Fix available
1 of 1
affected package

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Carried by container images the latest versions of 1,075 of 17,985 indexed charts deploy, on 1,073 images.

Affected packageAffected versionsFixed inImages
jackson-coremaven2.8.1, 2.8.4, 2.8.6, 2.8.7+91 more2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more1,073
OSV records
GHSA-7hhh-6rmp-j9qf
Trending
Rank 3 in indexed charts, since 2 Oct 2026. See the ranking →

Charts affected

1,075 by stars
ChartLatestAffected imagesRadar Score
apache-ranger-admindata-platform-stableVerified publisher0.2.01 of 2See more

apache-ranger-admin data-platform-stable 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
jackson-core@2.10.3
2.18.11

Open the chart page →

9,386
pagesdavid-pages1.0.01 of 3See more

pages david-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
db2restdb2rest0.2.01 of 1See more

db2rest db2rest 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
kdhrubo/db2rest:lateste20610ff81b0
jackson-core@2.19.2
2.21.7

Open the chart page →

1,046
pagesdebasish-pages1.0.01 of 3See more

pages debasish-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
deployhubdeployhubVerified publisher10.0.4151 of 11See more

deployhub deployhub 10.0.415

1 of the 11 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/deployhub/ms-ui:svccat-v11.0.815-g717581f5dedbc31e6f
jackson-core@2.14.2
2.18.11

Open the chart page →

12,846
eoloplannerdfa-amm-eoloplannerVerified publisher0.1.02 of 7See more

eoloplanner dfa-amm-eoloplanner 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
amartinm82/planner:v2.01184353ff57b
jackson-core@2.11.3
2.18.11
oscarsotosanchez/toposervice:v1.0d4d020e9f272
jackson-core@2.11.3
2.18.11

Open the chart page →

31,764
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
epam/ai-dial-admin-backend:0.21.08b91130e3731
jackson-core@2.22.1
2.22.3

Open the chart page →

4,102
pagesdipak1.0.01 of 3See more

pages dipak 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
api-postsdniel0.9.11 of 1See more

api-posts dniel 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dniel/api-posts:master45a667852f2a
jackson-core@2.10.0
2.18.11

Open the chart page →

9,289
forwardauthdniel2.0.131 of 1See more

forwardauth dniel 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dniel/forwardauth:latestf67129ea1c64
jackson-core@2.9.9
2.18.11

Open the chart page →

4,614
kafka-uidoubanVerified publisher1.5.21 of 1See more

kafka-ui douban 1.5.2

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
jackson-core@2.18.2
2.18.11

Open the chart page →

1,440
eoloplannerdreyg-jescribanob-chart-eoloplanner0.1.01 of 7See more

eoloplanner dreyg-jescribanob-chart-eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
oscarsotosanchez/toposervice:v1.0d4d020e9f272
jackson-core@2.11.3
2.18.11

Open the chart page →

28,226
drogue-cloud-coredrogue-iotVerified publisher0.7.111 of 22See more

drogue-cloud-core drogue-iot 0.7.11

1 of the 22 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0054ef67eb7da
jackson-core@2.13.4
2.18.11

Open the chart page →

57,806
drogue-cloud-twindrogue-iotVerified publisher0.7.111 of 8See more

drogue-cloud-twin drogue-iot 0.7.11

1 of the 8 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0054ef67eb7da
jackson-core@2.13.4
2.18.11

Open the chart page →

7,147
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
rundeck/rundeck:3.2.74d64fe56f767
jackson-core@2.10.1
2.18.11

Open the chart page →

20,324
dshackledysnixVerified publisher0.1.11 of 2See more

dshackle dysnix 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.12ac2a4bc66ab6
jackson-core@2.11.0
2.18.11

Open the chart page →

2,388
entrypoint-balancereclipse-aeriosVerified publisher1.3.01 of 1See more

entrypoint-balancer eclipse-aerios 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
eclipseaerios/entrypoint-balancer:1.3.043cd999a008d
jackson-core@2.15.4
2.18.11

Open the chart page →

2,647
idmeclipse-aeriosVerified publisher2.0.01 of 2See more

idm eclipse-aerios 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.6.39b0330756022
jackson-core@2.21.2
2.21.7

Open the chart page →

5,742
management-portaleclipse-aeriosVerified publisher1.1.01 of 2See more

management-portal eclipse-aerios 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
eclipseaerios/management-portal-backend:1.2.215fba526a4f8
jackson-core@2.15.4
2.18.11

Open the chart page →

4,105
mintakaeclipse-aeriosVerified publisher1.0.01 of 2See more

mintaka eclipse-aerios 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
fiware/mintaka:0.7.092a3c5cf43c0
jackson-core@2.13.3
2.18.11

Open the chart page →

12,708
pagesedgwarepages1.0.01 of 3See more

pages edgwarepages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-core@2.11.0
2.18.11

Open the chart page →

21,119
unifiegebackVerified publisher2.1.61 of 1See more

unifi egeback 2.1.6

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
jacobalberty/unifi:v10.0.162896c0ab82d33
jackson-core@2.17.3
2.18.11

Open the chart page →

8,215
egeria-baseegeria-charts4.3.01 of 5See more

egeria-base egeria-charts 4.3.0

1 of the 5 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
jackson-core@2.15.2
2.18.11

Open the chart page →

4,259
egeria-ctsegeria-charts4.3.01 of 3See more

egeria-cts egeria-charts 4.3.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
jackson-core@2.15.2
2.18.11

Open the chart page →

4,242
egeria-ptsegeria-charts4.3.01 of 3See more

egeria-pts egeria-charts 4.3.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
jackson-core@2.15.2
2.18.11

Open the chart page →

4,242
odpi-egeria-labegeria-charts4.3.01 of 4See more

odpi-egeria-lab egeria-charts 4.3.0

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
jackson-core@2.15.2
2.18.11

Open the chart page →

4,242
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
jackson-core@2.16.2
2.18.11

Open the chart page →

3,851
cerebroempathyco2.1.01 of 1See more

cerebro empathyco 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
lmenezes/cerebro:0.9.47d9e2b77e459
jackson-core@2.10.5
2.18.11

Open the chart page →

1,371
elasticsearch-umbrellaempathyco0.8.121 of 3See more

elasticsearch-umbrella empathyco 0.8.12

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
empathyco/elasticsearch:7.17.2-memlock03e724e41eeb
jackson-core@2.10.4
2.18.11

Open the chart page →

11,807
yaadeencircle360-ossVerified publisher0.2.11 of 1See more

yaade encircle360-oss 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
esperotech/yaade:latest24d2d692d948
jackson-core@2.15.3
2.18.11

Open the chart page →

1,133
eolicplantseolicplantsVerified publisher0.1.02 of 7See more

eolicplants eolicplants 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
oscarsotosanchez/planner:v1.0730c00a099b8
jackson-core@2.11.3
2.18.11
oscarsotosanchez/toposervice:v1.0d4d020e9f272
jackson-core@2.11.3
2.18.11

Open the chart page →

31,378
eoloPlanteolo-plannerVerified publisher0.1.03 of 7See more

eoloPlant eolo-planner 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.239fb4c11e6a49
jackson-core@2.14.1
2.18.11
mastercloudapps/planner:v1.2340a950b311b2
jackson-core@2.13.0
2.18.11
mastercloudapps/server:v2.23f3d24dfe2686
jackson-core@2.13.4
2.18.11

Open the chart page →

30,492
eoloplannereoloplannerVerified publisher0.1.03 of 7See more

eoloplanner eoloplanner 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
jackson-core@2.13.0
2.18.11
codeurjc/server:v1.0310bea5b1ee7
jackson-core@2.13.4
2.18.11
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-core@2.14.1
2.18.11

Open the chart page →

36,714
eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelmVerified publisher0.1.03 of 7See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.239fb4c11e6a49
jackson-core@2.14.1
2.18.11
mastercloudapps/planner:v1.2340a950b311b2
jackson-core@2.13.0
2.18.11
mastercloudapps/server:v2.23f3d24dfe2686
jackson-core@2.13.4
2.18.11

Open the chart page →

30,492
eoloplanner-mcaeoloplanner-mcaVerified publisher0.1.02 of 7See more

eoloplanner-mca eoloplanner-mca 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
franrobles8/planner:v3.099985392d63c
jackson-core@2.11.3
2.18.11
oscarsotosanchez/toposervice:v1.0d4d020e9f272
jackson-core@2.11.3
2.18.11

Open the chart page →

31,327
eoloplannereoloplanner-molynx-gat0.1.03 of 7See more

eoloplanner eoloplanner-molynx-gat 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
codeurjc/server:v1.0310bea5b1ee7
jackson-core@2.13.4
2.18.11
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-core@2.14.1
2.18.11
molynx/planner:v1441c9f52f092
jackson-core@2.13.0
2.18.11

Open the chart page →

33,043
eolo-plannereolo-planner-repo0.1.02 of 7See more

eolo-planner eolo-planner-repo 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
arturisimo/planner:v1.0fff9de644941
jackson-core@2.13.0
2.18.11
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-core@2.14.1
2.18.11

Open the chart page →

32,515
eoloplanteoloplant1.0.03 of 7See more

eoloplant eoloplant 1.0.0

3 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.239fb4c11e6a49
jackson-core@2.14.1
2.18.11
mastercloudapps/planner:v1.2340a950b311b2
jackson-core@2.13.0
2.18.11
mastercloudapps/server:v2.23f3d24dfe2686
jackson-core@2.13.4
2.18.11

Open the chart page →

30,492
eoloplantseoloplants-urjcVerified publisher0.1.03 of 7See more

eoloplants eoloplants-urjc 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
codeurjc/server:v1.0310bea5b1ee7
jackson-core@2.13.4
2.18.11
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-core@2.14.1
2.18.11
lourdesmorente/new-planner:1.0.0608745878cdb
jackson-core@2.13.0
2.18.11

Open the chart page →

32,262
servereoloserverVerified publisher0.1.03 of 7See more

server eoloserver 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
jackson-core@2.13.0
2.18.11
codeurjc/server:v1.0310bea5b1ee7
jackson-core@2.13.4
2.18.11
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-core@2.14.1
2.18.11

Open the chart page →

36,714
flywayeosc-lot-1Verified publisher0.7.01 of 3See more

flyway eosc-lot-1 0.7.0

1 of the 3 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
flyway/flyway:9.1545b5d7cdc75a
jackson-core@2.13.4
2.18.11

Open the chart page →

74,565
gerrit-operatorepmdedpVerified publisher2.25.01 of 2See more

gerrit-operator epmdedp 2.25.0

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
epamedp/edp-gerrit:3.14.249e8fe9c4855
jackson-core@2.21.1
2.21.7

Open the chart page →

1,408
shenyuerdeng2.4.212 of 2See more

shenyu erdeng 2.4.21

2 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
jackson-core@2.10.1
2.18.11
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
jackson-core@2.10.1
2.18.11

Open the chart page →

12,719
dshackleethereum-helm-chartsVerified publisher0.1.91 of 2See more

dshackle ethereum-helm-charts 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.14.0126f0ae0b388
jackson-core@2.11.0
2.18.11

Open the chart page →

2,173
tekuethereum-helm-chartsVerified publisher1.2.11 of 2See more

teku ethereum-helm-charts 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
consensys/teku:latest6bfef491dc27
jackson-core@2.22.1
2.22.3

Open the chart page →

825
web3signerethereum-helm-chartsVerified publisher1.0.61 of 4See more

web3signer ethereum-helm-charts 1.0.6

1 of the 4 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
consensys/web3signer:latestf146a51a1ba3
jackson-core@2.21.2
2.21.7

Open the chart page →

2,387
spring-boot-adminevryfs-ossVerified publisher0.1.101 of 1See more

spring-boot-admin evryfs-oss 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
quay.io/evryfs/spring-boot-admin:2.7.1060950ef63764
jackson-core@2.13.4
2.18.11

Open the chart page →

6,385
eximeebpmseximeebpms-k8sOfficialVerified publisher0.4.01 of 1See more

eximeebpms eximeebpms-k8s 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
ghcr.io/eximeebpms/eximeebpms-bpm-platform:run-1.4.00f4a5c0eea07
jackson-core@2.22.2
2.22.3

Open the chart page →

251
factor-platformfactorhouseVerified publisher0.0.51 of 1See more

factor-platform factorhouse 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
factorhouse/factor-platform:96.5b19f8edcb778
jackson-core@2.22.2
2.22.3

Open the chart page →

102
jenkinsfatihtepe-jenkins1.0.01 of 1See more

jenkins fatihtepe-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-89425.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-core@2.20.1
2.21.7

Open the chart page →

3,140

Container images carrying it

1,073 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/maximilianopizarro/neuralbank-backend:latesta53899fcfc01
jackson-core@2.20.0
2.21.7
1
quay.io/maximilianopizarro/openshift-integration-operator:v0.8.2d6fc43ac802e
jackson-core@2.21.4
2.21.7
1
quay.io/maximilianopizarro/showroom-docs-mcp:latest1a6eff92827a
jackson-core@2.21.2
2.21.7
1
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
jackson-core@2.15.3
2.18.11
1
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
jackson-core@2.19.2
2.21.7
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
jackson-core@2.10.1
2.18.11
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
jackson-core@2.14.1
2.18.11
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
jackson-core@2.15.3
2.18.11
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
jackson-core@2.15.3
2.18.11
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
jackson-core@2.15.3
2.18.11
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
jackson-core@3.1.4
3.1.7
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
jackson-core@3.1.4
3.1.7
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
jackson-core@2.17.2
2.18.11
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
jackson-core@2.13.5
2.18.11
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
jackson-core@2.12.3
2.18.11
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-core@2.22.0
2.22.3
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-core@2.19.2
2.21.7
1
quay.io/strimzi/operator:latest39cae00160b3
jackson-core@2.22.2
2.22.3
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-core@2.16.2
2.18.11
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-core@2.13.4
2.18.11
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-core@2.14.2
2.18.11
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-core@2.17.2
2.18.11
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-core@2.18.0
2.18.11
1

syft 1.42.1 · advisories as of 3 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.