StackRadar

CVE-2026-91777

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,055
of 17,985 indexed, latest versions
Container images
1,055
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind quadratic forward-reference completion

Carried by container images the latest versions of 1,055 of 17,985 indexed charts deploy, on 1,055 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.5.0, 2.5.3, 2.5.4, 2.6.0+120 more2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more1,055
OSV records
GHSA-cxp5-3px4-pw24
Trending
Rank 7 in indexed charts, since 1 Oct 2026. See the ranking →

Charts affected

1,055 by stars
ChartLatestAffected imagesRadar Score
tampkubebb5.6.01 of 2See more

tamp kubebb 5.6.0

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
kubebb/gateway-api:v5.6.04d062f20309c
jackson-databind@2.13.4
2.18.11

Open the chart page →

4,759
tapm-componentkubebb5.7.12 of 3See more

tapm-component kubebb 5.7.1

2 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
refar/apm-api:v5.7.1241373fa2972
jackson-databind@2.11.1
2.18.11
refar/apm-operator-server:v5.7.1e5490f050f9f
jackson-databind@2.11.1
2.18.11

Open the chart page →

10,430
tdsfkubebb5.7.01 of 3See more

tdsf kubebb 5.7.0

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
kubebb/mesh-api:v5.7.0a3879931dfa1
jackson-databind@2.13.3
2.18.11

Open the chart page →

6,583
sonarqubekubesphereVerified publisher6.7.01 of 3See more

sonarqube kubesphere 6.7.0

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
library/sonarqube:8.9-communityeb2f0be32efd
jackson-databind@2.13.2.2
2.18.11

Open the chart page →

2,381
skywalkingkubesphere-carryon-experimental0.6.02 of 5See more

skywalking kubesphere-carryon-experimental 0.6.0

2 of the 5 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:6.5.0c1ee839ccad0
jackson-databind@2.9.5
2.18.11
apache/skywalking-ui:6.5.0a84f9d9b8067
jackson-databind@2.8.11.1
2.18.11

Open the chart page →

13,620
clickhousekubesphere-carryon-test0.1.11 of 2See more

clickhouse kubesphere-carryon-test 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
radondb/zookeeper:3.6.216981604f1a0
jackson-databind@2.10.3
2.18.11

Open the chart page →

6,978
hertzbeatkubesphere-carryon-test1.4.11 of 4See more

hertzbeat kubesphere-carryon-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
apache/iotdb:0.13.3-nodeafa47bf1692a
jackson-databind@2.10.5
2.18.11

Open the chart page →

8,149
nacoskubesphere-carryon-test0.1.11 of 1See more

nacos kubesphere-carryon-test 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
nacos/nacos-server:1.4.1fe6e5688cdf3
jackson-databind@2.10.4
2.18.11

Open the chart page →

4,251
skywalkingkubesphere-carryon-test3.1.02 of 4See more

skywalking kubesphere-carryon-test 3.1.0

2 of the 4 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.1.0-es7641237e0299b
jackson-databind@2.9.5
2.18.11
apache/skywalking-ui:8.1.067d50e4deff4
jackson-databind@2.9.10
2.18.11

Open the chart page →

18,164
fpga-operatorkubesphere-stable2.7.41 of 7See more

fpga-operator kubesphere-stable 2.7.4

1 of the 7 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
inaccel/coral:2.18c53744ed70b
jackson-databind@2.13.5
2.18.11

Open the chart page →

5,865
clickhousekubesphere-testVerified publisher0.1.11 of 2See more

clickhouse kubesphere-test 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
radondb/zookeeper:3.6.216981604f1a0
jackson-databind@2.10.3
2.18.11

Open the chart page →

6,978
nacoskubesphere-testVerified publisher0.1.11 of 1See more

nacos kubesphere-test 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
nacos/nacos-server:1.4.1fe6e5688cdf3
jackson-databind@2.10.4
2.18.11

Open the chart page →

4,251
penpotkubitodevVerified publisher1.2.12 of 5See more

penpot kubitodev 1.2.1

2 of the 5 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
penpotapp/backend:2.2.147853d9bb9dd
jackson-databind@2.15.2
2.18.11
penpotapp/exporter:2.2.15c835ffd87ab
jackson-databind@2.12.4
2.18.11

Open the chart page →

18,531
fstyr-ddp-keycloak-application-platform-configkvalitetsitVerified publisher0.1.131 of 1See more

fstyr-ddp-keycloak-application-platform-config kvalitetsit 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
adorsys/keycloak-config-cli:6.3.0-26.1.085be7a45a94c
jackson-databind@2.17.2
2.18.11

Open the chart page →

3,458
keycloak-application-platform-configkvalitetsitVerified publisher0.0.291 of 1See more

keycloak-application-platform-config kvalitetsit 0.0.29

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
adorsys/keycloak-config-cli:6.1.6-25.0.1eb49a2dcbbb8
jackson-databind@2.17.1
2.18.11

Open the chart page →

3,686
stakitkvalitetsitVerified publisher0.3.111 of 3See more

stakit kvalitetsit 0.3.11

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
kvalitetsit/stakit-backend:0.3.0f0af0ba589af
jackson-databind@2.17.1
2.18.11

Open the chart page →

8,187
strimzi-kafka-operatorkvalitetsitVerified publisher0.36.11 of 1See more

strimzi-kafka-operator kvalitetsit 0.36.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-databind@2.14.2
2.18.11

Open the chart page →

4,303
imageboxkyso1.0.01 of 1See more

imagebox kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
kyso/imagebox:latest68091eace89c
jackson-databind@2.9.8
2.18.11

Open the chart page →

3,867
mock-oidclabs64io-helm-chartsVerified publisher0.1.21 of 1See more

mock-oidc labs64io-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ghcr.io/navikt/mock-oauth2-server:2.1.1065d4ed47ce09
jackson-databind@2.17.2
2.18.11

Open the chart page →

854
ladeitladeit0.4.01 of 2See more

ladeit ladeit 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ladeit/ladeit:latest962b665ffe82
jackson-databind@2.9.7
2.18.11

Open the chart page →

26,969
pageslatif-pages1.0.01 of 3See more

pages latif-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-databind@2.11.0
2.18.11

Open the chart page →

20,800
pageslavanya-pages1.0.01 of 3See more

pages lavanya-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-databind@2.11.0
2.18.11

Open the chart page →

20,800
wiremocklebenitzaVerified publisher0.3.11 of 1See more

wiremock lebenitza 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
rodolpheche/wiremock:2.27.22328a9fce2bf
jackson-databind@2.11.0
2.18.11

Open the chart page →

2,490
jenkinsleechistest2.7.11 of 2See more

jenkins leechistest 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.7

Open the chart page →

4,872
komgalinkding0.2.31 of 1See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
gotson/komga:1.22.0ba892ab3e082
jackson-databind@2.18.1
2.18.11

Open the chart page →

3,281
pagesliviu884422-pages1.0.01 of 3See more

pages liviu884422-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-databind@2.11.0
2.18.11

Open the chart page →

20,800
filebeatlog10x-elastic-helm-chartsVerified publisher1.5.11 of 1See more

filebeat log10x-elastic-helm-charts 1.5.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
log10x/filebeat-10x:1.1.39-native7d6a79dacd58
jackson-databind@2.21.5
2.21.7

Open the chart page →

7,133
reporter-10xlog10x-helm-chartsVerified publisher1.2.31 of 2See more

reporter-10x log10x-helm-charts 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
log10x/edge-10x:1.1.744d6f596ed0c9
jackson-databind@2.21.5
2.21.7

Open the chart page →

2,869
rocketmq-exporterlogic3579Verified publisher0.0.21 of 1See more

rocketmq-exporter logic3579 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
apache/rocketmq-exporter:0.0.2c8fb51195444
jackson-databind@2.13.5
2.18.11

Open the chart page →

7,013
allure_docker_servicelovemew67Verified publisher0.0.11 of 1See more

allure_docker_service lovemew67 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.27.00815040339a9
jackson-databind@2.16.1
2.18.11

Open the chart page →

66,213
efklovemew67Verified publisher0.0.11 of 2See more

efk lovemew67 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
nshou/elasticsearch-kibana:kibana7a1d1e36814d1
jackson-databind@2.14.2
2.18.11

Open the chart page →

4,050
vulnerability-scaninglovemew67Verified publisher0.0.31 of 2See more

vulnerability-scaning lovemew67 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.35.14154286c0209
jackson-databind@2.20.0
2.21.7

Open the chart page →

5,662
kafka-connect-wrapperlsmhun0.1.01 of 1See more

kafka-connect-wrapper lsmhun 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
lsmaster/kafka-connect-wrapper:6.1.0-0.1061eb5fbfa00
jackson-databind@2.11.1
2.18.11

Open the chart page →

2,486
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch:1.4.06df71eb04639
jackson-databind@2.8.11.3
2.18.11

Open the chart page →

8,102
elastictranscoderluiscajl0.46.04 of 4See more

elastictranscoder luiscajl 0.46.0

4 of the 4 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
elastictranscoder/media:627e21dc963ab3858c6b
jackson-databind@2.12.3
2.18.11
elastictranscoder/media-storage:f6d861a026208b8c2359
jackson-databind@2.12.3
2.18.11
elastictranscoder/transcoder:627e21dcb4a0327029e6
jackson-databind@2.12.3
2.18.11
elastictranscoder/transcoder-handler:627e21dc5b75d19e2733
jackson-databind@2.12.3
2.18.11

Open the chart page →

60,115
filebot-botluiscajl0.0.111 of 1See more

filebot-bot luiscajl 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
lavandadelpatio/filebot-bot:0.0.1-SNAPSHOTd2cba20aa4d8
jackson-databind@2.13.1
2.18.11

Open the chart page →

3,784
lavandaluiscajl0.0.1344 of 5See more

lavanda luiscajl 0.0.134

4 of the 5 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
lavandadelpatio/automated-download-films:0.0.2094e225a5a6f8
jackson-databind@2.11.2
2.18.11
lavandadelpatio/automated-download-shows:0.0.492de3c3426d2
jackson-databind@2.11.2
2.18.11
lavandadelpatio/filebot:0.0.671f2ccec8c0d
jackson-databind@2.11.4
2.18.11
lavandadelpatio/tmdb:0.0.2f36af885e915
jackson-databind@2.11.4
2.18.11

Open the chart page →

18,635
tmdbluiscajl0.2.41 of 1See more

tmdb luiscajl 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
lavandadelpatio/tmdb:latestded9377636e9
jackson-databind@2.15.3
2.18.11

Open the chart page →

2,321
torznab-atomohdluiscajl0.0.31 of 1See more

torznab-atomohd luiscajl 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
lavandadelpatio/torznab-atomohd:latest214eaef5444c
jackson-databind@2.14.2
2.18.11

Open the chart page →

3,395
joalm0nsterrr-joalVerified publisher2.2.01 of 2See more

joal m0nsterrr-joal 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
anthonyraymond/joal:2.1.37fc942567c564
jackson-databind@2.13.3
2.18.11

Open the chart page →

10,614
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
jackson-databind@2.13.2.2
2.18.11

Open the chart page →

25,506
eoloplantmca-eoloplaner0.1.02 of 7See more

eoloplant mca-eoloplaner 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
hugohg34/planner:0.0.2171f61e8d7e2
jackson-databind@2.13.0
2.18.11
hugohg34/toposervice:0.0.2812a03b3f274
jackson-databind@2.13.0
2.18.11

Open the chart page →

30,962
dependency-trackmediamarktsaturn1.9.21 of 2See more

dependency-track mediamarktsaturn 1.9.2

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dependencytrack/apiserver:4.14.21ba4f004e1ec
jackson-databind@2.21.1
2.21.7

Open the chart page →

4,263
tinymediamanagermedia-servarrVerified publisher1.6.41 of 2See more

tinymediamanager media-servarr 1.6.4

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
tinymediamanager/tinymediamanager:5.3.36f332431a2ae
jackson-databind@2.21.2
2.21.7

Open the chart page →

9,531
metabase-k8smetabase-k8s1.0.01 of 1See more

metabase-k8s metabase-k8s 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
metabase/metabase:v0.53.4.17807bc5cad17
jackson-databind@2.17.1
2.18.11

Open the chart page →

3,037
activemqmicroboxlabs3.8.01 of 1See more

activemq microboxlabs 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
alfresco/alfresco-activemq:5.18.7-jre17-rockylinux88c10693fe71a
jackson-databind@2.18.2
2.18.11

Open the chart page →

1,735
elasticmicroboxlabs0.3.01 of 1See more

elastic microboxlabs 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
library/elasticsearch:8.17.32cc40b15dff8
jackson-databind@2.15.0
2.18.11

Open the chart page →

4,692
miot-calendarmicroboxlabs0.1.01 of 1See more

miot-calendar microboxlabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-calendar:latest-jvm7abd9085613a
jackson-databind@2.20.1
2.21.7

Open the chart page →

2,204
miot-modulithmicroboxlabs0.6.01 of 1See more

miot-modulith microboxlabs 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-srv:latestd4782373f842
jackson-databind@2.21.5
2.21.7

Open the chart page →

1,674
modulariotmicroboxlabs0.11.01 of 4See more

modulariot microboxlabs 0.11.0

1 of the 4 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-srv:latestf368323486ac
jackson-databind@2.21.5
2.21.7

Open the chart page →

2,467

Container images carrying it

1,055 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-databind@2.16.2
2.18.11
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-databind@2.13.4.1
2.18.11
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-databind@2.14.2
2.18.11
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-databind@2.17.2
2.18.11
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-databind@2.13.5
2.18.11
1

syft 1.42.1 · advisories as of 2 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.