CVE-2026-91777
HighAdvisory
Published 30 Sept 2026In the index since 1 Oct 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.004
- 37th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,055
- of 17,985 indexed, latest versions
- Container images
- 1,055
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jackson-databind quadratic forward-reference completion
Carried by container images the latest versions of 1,055 of 17,985 indexed charts deploy, on 1,055 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jackson-databindmaven | 2.5.0, 2.5.3, 2.5.4, 2.6.0+120 more | 2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more | 1,055 |
- OSV records
- GHSA-cxp5-3px4-pw24
- Trending
- Rank 7 in indexed charts, since 1 Oct 2026. See the ranking →
Charts affected
1,055 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| zahori-serverzahoriVerified publisher | 1.0.1 | 2 of 2See more | 6,088 |
| keycloakxzaks | 2.2.0 | 1 of 1See more | 6,270 |
| jenkinszanise-jenkins-helm-chart | 0.1.0 | 1 of 1See more | 2,887 |
| language-toolzekker6Verified publisher | 1.12.1 | 1 of 2See more | 1,588 |
| zipkinzipkinVerified publisher | 0.5.0 | 1 of 1See more | 1,356 |
Container images carrying it
1,055 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| tolgee/ | 170242202255 | jackson-databind | 3.1.7 | 1 |
| torrespro/ | 6d3bd305a1ba | jackson-databind | 2.18.11 | 1 |
| traccar/ | 621c8d6d46fd | jackson-databind | 2.18.11 | 1 |
| treskon/ | 88e813f22347 | jackson-databind | 2.18.11 | 1 |
| trinodb/ | 1565e8cac299 | jackson-databind | 2.21.7 | 1 |
| trinodb/ | 38c6f24ab1a4 | jackson-databind | 2.18.11 | 1 |
| trinodb/ | 5b5e0a97f599 | jackson-databind | 2.21.7 | 1 |
| trinodb/ | 6af989b0846d | jackson-databind | 2.21.7 | 1 |
| trinodb/ | ee80ab5eeab2 | jackson-databind | 2.18.11 | 1 |
| trinodb/ | 12c884f235aa | jackson-databind | 2.22.3 | 1 |
| verapdf/ | 341359ac6af5 | jackson-databind | 2.21.7 | 1 |
| vespaengine/ | 69b160f58211 | jackson-databind | 2.18.11 | 1 |
| vientoprojects/ | eb2a71531741 | jackson-databind | 2.18.11 | 1 |
| vincentgwzhang/ | a9139f2cd98f | jackson-databind | 2.18.11 | 1 |
| vitalii1992/ | 0e694d94551d | jackson-databind | 2.18.11 | 1 |
| vitalii1992/ | 8e798836ecea | jackson-databind | 2.18.11 | 1 |
| vitalii1992/ | aabe6ac39356 | jackson-databind | 2.18.11 | 1 |
| vitalii1992/ | 07c4a8833ce4 | jackson-databind | 2.18.11 | 1 |
| vitalii1992/ | 44d2d6e00ab3 | jackson-databind | 2.18.11 | 1 |
| vlebediantsev/ | e7f20450d2ae | jackson-databind | 2.18.11 | 1 |
| vlebediantsev/ | 10393a89b4a8 | jackson-databind | 2.18.11 | 1 |
| vlebediantsev/ | df8bf38c535b | jackson-databind | 2.18.11 | 1 |
| vlebediantsev/ | 427af418b75e | jackson-databind | 2.18.11 | 1 |
| vlebediantsev/ | 9319437f3c8f | jackson-databind | 2.18.11 | 1 |
| voltha/ | e038acb950d3 | jackson-databind | 2.18.11 | 1 |
| vrijbrp/ | 5c770c2ae48c | jackson-databind | 2.18.11 | 1 |
| wavefronthq/ | d1064d28f6eb | jackson-databind | 2.18.11 | 1 |
| wazuh/ | 9c344d2b1757 | jackson-databind | 2.18.11 | 1 |
| wazuh/ | a7a2076b167e | jackson-databind | 2.18.11 | 1 |
| wazuh/ | b149b30da686 | jackson-databind | 2.18.11 | 1 |
| wistefan/ | e0887302b2d8 | jackson-databind | 2.18.11 | 1 |
| woojoong/ | ec230db19652 | jackson-databind | 2.18.11 | 1 |
| wso2/ | fbe0f4059b74 | jackson-databind | 2.18.11 | 1 |
| wso2/ | 05fa15b3d927 | jackson-databind | 2.18.11 | 1 |
| wso2/ | 526a1ccae902 | jackson-databind | 2.18.11 | 1 |
| wso2/ | 21e6b03449ac | jackson-databind | 2.18.11 | 1 |
| wso2/ | 790cd8c3a5a2 | jackson-databind | 2.18.11 | 1 |
| xeotek/ | 39a3b37a17c5 | jackson-databind | 2.18.11 | 1 |
| xeotek/ | 4c6b04d9ce55 | jackson-databind | 2.18.11 | 1 |
| yuzutech/ | 192b7b27c857 | jackson-databind | 2.18.11 | 1 |
| zahoriaut/ | 351f8a220ed7 | jackson-databind | 2.18.11 | 1 |
| zahoriaut/ | b2de13916f3e | jackson-databind | 2.18.11 | 1 |
| zammad/ | 8274d75a51fc | jackson-databind | 2.18.11 | 1 |
| zbalogh/ | 7c247e399a1f | jackson-databind | 2.18.11 | 1 |
| zenko/ | 386a1f48ec0e | jackson-databind | 2.18.11 | 1 |
| gcr.io/ | 0ee5f968d2ab | jackson-databind | 2.18.11 | 1 |
| gcr.io/ | ae57b62291aa | jackson-databind | 2.21.7 | 1 |
| ghcr.io/ | e9c2ce635b89 | jackson-databind | 2.18.11 | 1 |
| ghcr.io/ | 4a2824296412 | jackson-databind | 2.18.11 | 1 |
| ghcr.io/ | 449dc880bbfb | jackson-databind | 3.1.7 | 1 |