StackRadar

CVE-2026-91777

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,055
of 17,985 indexed, latest versions
Container images
1,055
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind quadratic forward-reference completion

Carried by container images the latest versions of 1,055 of 17,985 indexed charts deploy, on 1,055 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.5.0, 2.5.3, 2.5.4, 2.6.0+120 more2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more1,055
OSV records
GHSA-cxp5-3px4-pw24
Trending
Rank 7 in indexed charts, since 1 Oct 2026. See the ranking →

Charts affected

1,055 by stars
ChartLatestAffected imagesRadar Score
hazelcast-jethazelcastVerified publisher1.17.11 of 1See more

hazelcast-jet hazelcast 1.17.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
hazelcast/hazelcast-jet:4.5.3a825ecbe9fda
jackson-databind@2.11.4
2.18.11

Open the chart page →

6,221
hbasehbase0.1.72 of 4See more

hbase hbase 0.1.7

2 of the 4 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
jackson-databind@2.13.3
2.18.11
ghcr.io/fleeksoft/hbase/hdfs:3.3.3.2ac62269785ac
jackson-databind@2.13.2.2
2.18.11

Open the chart page →

10,773
nacosheidaodageshiwoVerified publisher0.1.51 of 1See more

nacos heidaodageshiwo 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
nacos/nacos-server:v2.1.0dcf04549c6d7
jackson-databind@2.12.2
2.18.11

Open the chart page →

4,088
hello-world-apihello-world-api0.0.51 of 1See more

hello-world-api hello-world-api 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
fabioformosa/hello-world-api:latest063873af085c
jackson-databind@2.18.3
2.18.11

Open the chart page →

1,520
helm-airportshelm-airports0.1.04 of 7See more

helm-airports helm-airports 0.1.0

4 of the 7 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dina1993/airports-api:latestac731244aed1
jackson-databind@2.14.2
2.18.11
dina1993/airports-consumer:latest669d146a5e63
jackson-databind@2.14.2
2.18.11
dina1993/airports-producer:latest3d6b0dac1cb4
jackson-databind@2.14.2
2.18.11
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.11

Open the chart page →

13,078
airports-kafkahelm-airports-dan0.1.01 of 2See more

airports-kafka helm-airports-dan 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.11

Open the chart page →

4,683
helm-airportshelm-airports-dan0.1.01 of 7See more

helm-airports helm-airports-dan 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.11

Open the chart page →

5,714
airports-kafkahelm-airports-kafka0.1.01 of 2See more

airports-kafka helm-airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.11

Open the chart page →

4,683
jenkinshelm-chart-for-jenkinsVerified publisher1.0.01 of 1See more

jenkins helm-chart-for-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.7

Open the chart page →

2,887
pageshelm-chart-repos-camden1.0.01 of 3See more

pages helm-chart-repos-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-databind@2.11.0
2.18.11

Open the chart page →

20,800
springboothelmcharts1.0.01 of 1See more

springboot helmcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
kimb88/hello-world-spring-boot:latest0639155241cb
jackson-databind@2.9.6
2.18.11

Open the chart page →

6,486
metabasehelm-charts-nr0.14.41 of 1See more

metabase helm-charts-nr 0.14.4

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
metabase/metabase:v0.45.21fb334ce4820
jackson-databind@2.13.4.2
2.18.11

Open the chart page →

2,654
wiremockhelm-charts-nr1.4.61 of 2See more

wiremock helm-charts-nr 1.4.6

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
rodolpheche/wiremock:2.26.03be08a386092
jackson-databind@2.10.0
2.18.11

Open the chart page →

2,191
cruise-controlhelm-cruise-controlVerified publisher2.2.01 of 2See more

cruise-control helm-cruise-control 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/kafka-cruise-control:jdk17-cc2.5.146-iam2.3.90885af088157
jackson-databind@2.22.1
2.22.3

Open the chart page →

1,598
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dannielkil/book-backend:lateste3b479a55a69
jackson-databind@2.13.3
2.18.11

Open the chart page →

9,568
jasperreportshelm-dojo8.0.0-v1.31 of 2See more

jasperreports helm-dojo 8.0.0-v1.3

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
palopalepalo/jasperreports:8-v1.356b99b194d20
jackson-databind@2.13.2.2
2.18.11

Open the chart page →

6,668
alfiohelmforgeVerified publisher1.2.121 of 3See more

alfio helmforge 1.2.12

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
alfio/alf.io:2.0-M5-26060c836a081446
jackson-databind@2.21.2
2.21.7

Open the chart page →

2,040
archiveboxhelmforgeVerified publisher1.1.131 of 1See more

archivebox helmforge 1.1.13

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.708c21bb233130
jackson-databind@2.22.2
2.22.3

Open the chart page →

5,691
booklorehelmforgeVerified publisher2.0.21 of 3See more

booklore helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
jackson-databind@2.21.4
2.21.7

Open the chart page →

2,116
ckanhelmforgeVerified publisher1.3.91 of 6See more

ckan helmforge 1.3.9

1 of the 6 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
jackson-databind@2.12.7.1
2.18.11

Open the chart page →

10,398
druidhelmforgeVerified publisher1.3.62 of 4See more

druid helmforge 1.3.6

2 of the 4 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
jackson-databind@2.19.2
2.21.7
library/zookeeper:3.9.57d0f24ebb67b
jackson-databind@2.15.2
2.18.11

Open the chart page →

8,993
elasticsearchhelmforgeVerified publisher1.1.81 of 2See more

elasticsearch helmforge 1.1.8

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.3a4e2b3d21ad0
jackson-databind@2.21.5
2.21.7

Open the chart page →

426
jenkinshelmforgeVerified publisher1.0.91 of 1See more

jenkins helmforge 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
jenkins/jenkins:2.568.3-lts-jdk21c1e4c349365f
jackson-databind@3.1.3
3.1.7

Open the chart page →

2,887
kibanahelmforgeVerified publisher1.1.81 of 3See more

kibana helmforge 1.1.8

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.19656a9ca03f8
jackson-databind@2.18.8
2.18.11

Open the chart page →

546
komgahelmforgeVerified publisher1.4.161 of 1See more

komga helmforge 1.4.16

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
gotson/komga:1.27.19cf102f5fb78
jackson-databind@2.21.4
2.21.7

Open the chart page →

35,379
metabasehelmforgeVerified publisher1.2.301 of 3See more

metabase helmforge 1.2.30

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
metabase/metabase:v0.63.181160b570cb11
jackson-databind@2.21.6
2.21.7

Open the chart page →

1,561
minecrafthelmforgeVerified publisher1.5.51 of 1See more

minecraft helmforge 1.5.5

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
itzg/minecraft-server:2026.9.2de5d1b1a83eb
jackson-databind@2.22.2
2.22.3

Open the chart page →

4,360
zookeeperhelmforgeVerified publisher1.0.21 of 1See more

zookeeper helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
library/zookeeper:3.9.57d0f24ebb67b
jackson-databind@2.15.2
2.18.11

Open the chart page →

3,294
openaevhelm-openbasVerified publisher2.0.81 of 7See more

openaev helm-openbas 2.0.8

1 of the 7 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
openaev/platform:3.260923.06c512196d956
jackson-databind@2.22.2
2.22.3

Open the chart page →

8,162
openbashelm-openbasVerified publisher1.8.142 of 7See more

openbas helm-openbas 1.8.14

2 of the 7 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
openbas/platform:2.0.5d986d80b0a75
jackson-databind@2.17.3
2.18.11
opensearchproject/opensearch:3.3.2798cf28e226a
jackson-databind@2.17.1
2.18.11

Open the chart page →

27,489
pageshelm-repo1.0.01 of 3See more

pages helm-repo 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-databind@2.11.0
2.18.11

Open the chart page →

20,800
todo-apihelm-repo-sharif0.1.01 of 2See more

todo-api helm-repo-sharif 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
pavanelthepu/todo-api:1.0.2f47658e3b24c
jackson-databind@2.12.3
2.18.11

Open the chart page →

2,618
test-helm-charthelm-testVerified publisher0.1.01 of 1See more

test-helm-chart helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
prom/cloudwatch-exporter:cloudwatch_exporter-0.8.0fc4b9b9f5e15
jackson-databind@2.9.10.1
2.18.11

Open the chart page →

2,864
heronheron0.20.5-incubating1 of 2See more

heron heron 0.20.5-incubating

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
apache/bookkeeper:4.14.5a7d9970c148f
jackson-databind@2.11.0
2.18.11

Open the chart page →

1,567
hivemq-edgehivemqOfficialVerified publisher0.1.361 of 1See more

hivemq-edge hivemq 0.1.36

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
hivemq/hivemq-edge:2026.14d8250a233cea
jackson-databind@2.22.2
2.22.3

Open the chart page →

1,544
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
apache/tika:3.3.1.090b7fa1dc018
jackson-databind@2.21.3
2.21.7

Open the chart page →

30,686
eoloplanthttpd-eoloplant0.1.03 of 7See more

eoloplant httpd-eoloplant 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
jackson-databind@2.13.0
2.18.11
codeurjc/server:v1.0310bea5b1ee7
jackson-databind@2.13.4.2
2.18.11
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-databind@2.14.1
2.18.11

Open the chart page →

33,930
sys-info-web-env-view-serverhuajuan-helm-charts0.1.11 of 2See more

sys-info-web-env-view-server huajuan-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
huajuan6848/env-view-server:0.0.1-SNAPSHOTa303f3d9f6e0
jackson-databind@2.15.2
2.18.11

Open the chart page →

2,061
nexus3huangchengwu-helm-chart0.1.01 of 1See more

nexus3 huangchengwu-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
sonatype/nexus3:3.53.04bd975493104
jackson-databind@2.14.1
2.18.11

Open the chart page →

4,687
prometheushuangchengwu-helm-chart0.1.02 of 3See more

prometheus huangchengwu-helm-chart 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:9.2.0133d35d2c263
jackson-databind@2.13.2.2
2.18.11
apache/skywalking-ui:9.2.0295f1dc87d98
jackson-databind@2.13.2.2
2.18.11

Open the chart page →

17,234
skywalking-v1huangchengwu-helm-chart0.1.02 of 4See more

skywalking-v1 huangchengwu-helm-chart 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.9.1b4ec8c18d079
jackson-databind@2.12.2
2.18.11
apache/skywalking-ui:8.9.180530f0308a5
jackson-databind@2.12.2
2.18.11

Open the chart page →

21,264
mvfi4trustVerified publisher1.1.21 of 1See more

mvf i4trust 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
wistefan/mvf:lateste0887302b2d8
jackson-databind@2.12.1
2.18.11

Open the chart page →

7,625
vcwaltidi4trustVerified publisher0.0.191 of 1See more

vcwaltid i4trust 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
jackson-databind@2.14.2
2.18.11

Open the chart page →

8,407
ibm-business-automation-insights-devibm-charts3.2.02 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

2 of the 6 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ibmcom/bai-elasticsearch-dev:19.0.25441dba2fa00
jackson-databind@2.8.11.2
2.18.11
ibmcom/bai-flink-dev:19.0.2e31ff09e8aad
jackson-databind@2.9.8
2.18.11

Open the chart page →

39,933
ibm-kerify-devibm-charts1.0.01 of 1See more

ibm-kerify-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
jackson-databind@2.9.6
2.18.11

Open the chart page →

8,326
ibm-microclimateibm-charts0.1.03 of 8See more

ibm-microclimate ibm-charts 0.1.0

3 of the 8 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
jackson-databind@2.8.8
2.18.11
ibmcom/microclimate-theia:lateste17bdccc5030
jackson-databind@2.8.8
2.18.11
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.7

Open the chart page →

118,330
ibm-ws-dyn-agent-devibm-charts1.0.01 of 1See more

ibm-ws-dyn-agent-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ibmcom/ibm-workload-scheduler-agent-dynamic-dev:9.4.0.047e4dc1e27cdf
jackson-databind@2.9.4
2.18.11

Open the chart page →

19,636
ibm-events-operatoribm-helm6.0.0+20260126.110734.01 of 1See more

ibm-events-operator ibm-helm 6.0.0+20260126.110734.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:latest39cae00160b3
jackson-databind@2.22.2
2.22.3

Open the chart page →

101
tolgeeicoretechVerified publisher0.49.91 of 3See more

tolgee icoretech 0.49.9

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
tolgee/tolgee:v3.224.11170242202255
jackson-databind@3.1.6
3.1.7

Open the chart page →

3,114
eoloserverihuertas2021-vmartinp2021-helm0.1.03 of 7See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
codeurjc/server:v1.0310bea5b1ee7
jackson-databind@2.13.4.2
2.18.11
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-databind@2.14.1
2.18.11
huertaslopez/i.huertas.2021-v.martinp.2021-planner:2.0.0e2c18bd65472
jackson-databind@2.13.0
2.18.11

Open the chart page →

29,109

Container images carrying it

1,055 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-databind@2.16.2
2.18.11
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-databind@2.13.4.1
2.18.11
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-databind@2.14.2
2.18.11
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-databind@2.17.2
2.18.11
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-databind@2.13.5
2.18.11
1

syft 1.42.1 · advisories as of 2 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.