StackRadar

CVE-2026-91777

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,047
of 17,985 indexed, latest versions
Container images
1,044
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind quadratic forward-reference completion

Carried by container images the latest versions of 1,047 of 17,985 indexed charts deploy, on 1,044 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.5.0, 2.5.3, 2.5.4, 2.6.0+120 more2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more1,044
OSV records
GHSA-cxp5-3px4-pw24
Trending
Rank 39 in indexed charts, since 1 Oct 2026. See the ranking →

Charts affected

1,047 by stars
ChartLatestAffected imagesRadar Score
streamvisorstreamvisorVerified publisher4.1.61 of 1See more

streamvisor streamvisor 4.1.6

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
jackson-databind@2.21.2
2.21.7

Open the chart page →

3,138
strimzi-drain-cleanerstrimzi1.6.11 of 1See more

strimzi-drain-cleaner strimzi 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
quay.io/strimzi/drain-cleaner:1.6.15fb28e9f30d0
jackson-databind@2.21.2
2.21.7

Open the chart page →

696
strimzi-drain-cleanerstrimzi-drain-cleaner1.6.11 of 1See more

strimzi-drain-cleaner strimzi-drain-cleaner 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
quay.io/strimzi/drain-cleaner:1.6.15fb28e9f30d0
jackson-databind@2.21.2
2.21.7

Open the chart page →

696
graylogt3n1.0.01 of 3See more

graylog t3n 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
graylog2/server:2.4.3-38ff28c66e6c1
jackson-databind@2.8.9
2.18.11

Open the chart page →

8,131
snowplowt3n0.0.11 of 1See more

snowplow t3n 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
snowplow/scala-stream-collector-pubsub:2.2.041d318841516
jackson-databind@2.9.10.6
2.18.11

Open the chart page →

2,328
tenuretenureVerified publisher1.0.61 of 2See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
mongodb/mongodb-atlas-local:8e118f5c131c5
jackson-databind@2.18.9
2.18.11

Open the chart page →

2,972
jenkinstestchart0.1.91 of 2See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
jackson-databind@2.15.2
2.18.11

Open the chart page →

9,489
jenkinstest-jenkins9.1.01 of 2See more

jenkins test-jenkins 9.1.0

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
jackson-databind@2.15.2
2.18.11

Open the chart page →

9,489
tocktock0.6.36 of 9See more

tock tock 0.6.3

6 of the 9 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
tock/bot_admin:25.10.7df3e38c77a38
jackson-databind@2.20.0
2.21.7
tock/bot_api:25.10.7dd5d5c70e333
jackson-databind@2.20.0
2.21.7
tock/build_worker:25.10.7080cb6b08d5b
jackson-databind@2.20.0
2.21.7
tock/duckling:25.10.7ac1f3f1a1e9c
jackson-databind@2.20.0
2.21.7
tock/kotlin_compiler:25.10.7c9c0fb40089a
jackson-databind@2.20.0
2.21.7
tock/nlp_api:25.10.7c04ffe67b977
jackson-databind@2.20.0
2.21.7

Open the chart page →

15,188
trino-gatewaytrino1.21.01 of 1See more

trino-gateway trino 1.21.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
trinodb/trino-gateway:2112c884f235aa
jackson-databind@2.22.2
2.22.3

Open the chart page →

103
wavefront-adapter-for-istiowavefront0.1.41 of 2See more

wavefront-adapter-for-istio wavefront 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
wavefronthq/proxy:9.2d1064d28f6eb
jackson-databind@2.11.0
2.18.11

Open the chart page →

16,547
spark-operatorwikimedia2.2.71 of 1See more

spark-operator wikimedia 2.2.7

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
jackson-databind@2.13.4.2
2.18.11

Open the chart page →

57,965
workflows-aggregatorworkflows-aggregatorVerified publisher0.16.111 of 1See more

workflows-aggregator workflows-aggregator 0.16.11

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-databind@2.13.5
2.18.11

Open the chart page →

924
accountaccount-serviceVerified publisher0.4.21 of 1See more

account account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
vitalii1992/account-service:latest0e694d94551d
jackson-databind@2.15.0
2.18.11

Open the chart page →

2,220
analyticsaccount-serviceVerified publisher0.4.21 of 1See more

analytics account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
vitalii1992/analytics-service:latest8e798836ecea
jackson-databind@2.15.0
2.18.11

Open the chart page →

2,382
gatewayaccount-serviceVerified publisher0.4.21 of 1See more

gateway account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
vitalii1992/api-gateway-service:latestaabe6ac39356
jackson-databind@2.15.0
2.18.11

Open the chart page →

2,942
keycloakaccount-serviceVerified publisher18.4.51 of 2See more

keycloak account-service 18.4.5

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:17.0.1-legacy68f9f38c8f30
jackson-databind@2.12.1
2.18.11

Open the chart page →

7,922
orderaccount-serviceVerified publisher0.4.21 of 1See more

order account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
vitalii1992/order-service:latest07c4a8833ce4
jackson-databind@2.15.0
2.18.11

Open the chart page →

2,274
quotes-provideraccount-serviceVerified publisher0.4.21 of 1See more

quotes-provider account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
vitalii1992/quotes-provider-service:latest44d2d6e00ab3
jackson-databind@2.15.0
2.18.11

Open the chart page →

2,262
migrationadeptia-automate-migration5.2.91 of 1See more

migration adeptia-automate-migration 5.2.9

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
adeptiainc/adeptia-connect-migration:5.2.98607f4f29732
jackson-databind@2.19.4
2.21.7

Open the chart page →

584
jenkinsaditisingh-jenkins1.0.01 of 1See more

jenkins aditisingh-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.7

Open the chart page →

2,846
keycloak-operatoradnoctemVerified publisher0.3.01 of 1See more

keycloak-operator adnoctem 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak-operator:26.7.33172bf49511c
jackson-databind@2.21.5
2.21.7

Open the chart page →

95
airbyte-api-serverairbyteVerified publisher0.293.41 of 1See more

airbyte-api-server airbyte 0.293.4

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
airbyte/airbyte-api-server:0.63.8e1c5e7cfec8a
jackson-databind@2.17.0
2.18.11

Open the chart page →

949
airbyte-cronairbyteVerified publisher0.40.371 of 1See more

airbyte-cron airbyte 0.40.37

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
airbyte/cron:0.40.17caf4f551c546
jackson-databind@2.13.4.2
2.18.11

Open the chart page →

1,503
connector-rollout-workerairbyteVerified publisher1.9.21 of 1See more

connector-rollout-worker airbyte 1.9.2

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
airbyte/connector-rollout-worker:2.0.2-alpha-c905e75d42813fcc191
jackson-databind@2.20.1
2.21.7

Open the chart page →

956
airbyteairbyte-v2Verified publisher2.3.06 of 10See more

airbyte airbyte-v2 2.3.0

6 of the 10 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
airbyte/bootloader:2.3.0205b99d17c1a
jackson-databind@2.21.5
2.21.7
airbyte/cron:2.3.0bf4835757eaa
jackson-databind@2.21.5
2.21.7
airbyte/server:2.3.039141ed8ce5e
jackson-databind@2.21.5
2.21.7
airbyte/worker:2.3.0f2e33fbc53d1
jackson-databind@2.21.5
2.21.7
airbyte/workload-api-server:2.3.0434b4a811156
jackson-databind@2.21.5
2.21.7
airbyte/workload-launcher:2.3.00e18b1abcda6
jackson-databind@2.21.5
2.21.7

Open the chart page →

13,437
airbyte-data-planeairbyte-v2Verified publisher2.3.01 of 1See more

airbyte-data-plane airbyte-v2 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
airbyte/workload-launcher:2.3.00e18b1abcda6
jackson-databind@2.21.5
2.21.7

Open the chart page →

794
airports-apiairports-api0.1.01 of 1See more

airports-api airports-api 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dina1993/airports-api:latestac731244aed1
jackson-databind@2.14.2
2.18.11

Open the chart page →

2,024
airports-consumerairports-consumer0.1.01 of 1See more

airports-consumer airports-consumer 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dina1993/airports-consumer:latest669d146a5e63
jackson-databind@2.14.2
2.18.11

Open the chart page →

2,013
airports-kafkaairports-kafka0.1.01 of 2See more

airports-kafka airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.11

Open the chart page →

4,670
airports-producerairports-producer0.1.01 of 1See more

airports-producer airports-producer 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
dina1993/airports-producer:latest3d6b0dac1cb4
jackson-databind@2.14.2
2.18.11

Open the chart page →

2,013
airsonic-advancedairsonic-advancedVerified publisher0.3.11 of 1See more

airsonic-advanced airsonic-advanced 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
linuxserver/airsonic-advanced:11.1.4e9272f1fb326
jackson-databind@2.17.2
2.18.11

Open the chart page →

2,108
aktoakto0.2.05 of 7See more

akto akto 0.2.0

5 of the 7 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
jackson-databind@2.13.4.2
2.18.11
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
jackson-databind@2.13.4.2
2.18.11
public.ecr.aws/aktosecurity/akto-api-security-dashboard:latestb53a854bd7c1
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/akto-api-security-runtime:latestfacdfba6d4e4
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/akto-api-testing:latest97d830d5538a
jackson-databind@2.18.9
2.18.11

Open the chart page →

14,875
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
jackson-databind@2.16.1
2.18.11

Open the chart page →

49,591
akto-central-setupakto1.2.33See more

akto-central-setup akto 1.2.3

3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
aktosecurity/akto-threat-detection-backend:1.18.4b12ce3e2dc71
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.70.366b0ec8b3de3
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
jackson-databind@2.21.2
2.21.7

Open the chart page →

—
akto-dashboardakto0.1.71 of 1See more

akto-dashboard akto 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
aktosecurity/akto-api-security-dashboard:latest3ecdd301cdbd
jackson-databind@2.18.9
2.18.11

Open the chart page →

1,031
akto-dbabsakto0.1.91 of 1See more

akto-dbabs akto 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:latestac89679314c1
jackson-databind@2.18.9
2.18.11

Open the chart page →

994
akto-hybrid-redactakto1.44.73 of 5See more

akto-hybrid-redact akto 1.44.7

3 of the 5 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime:1.74.6_local8b9208c09d76
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/akto-api-security-mini-testing:1.74.4_local5bda14f66e8e
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
jackson-databind@2.19.0
2.21.7

Open the chart page →

5,535
akto-mini-runtimeakto0.7.222 of 3See more

akto-mini-runtime akto 0.7.22

2 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime:latest8b9208c09d76
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-databind@2.21.2
2.21.7

Open the chart page →

3,235
akto-mini-runtime-shaakto0.7.232 of 3See more

akto-mini-runtime-sha akto 0.7.23

2 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-runtimedigest-pinned4d3a8042c761
jackson-databind@2.16.1
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafkadigest-pinnedd20bd62f0182
jackson-databind@2.19.0
2.21.7

Open the chart page →

3,736
akto-mini-testingakto1.45.72 of 5See more

akto-mini-testing akto 1.45.7

2 of the 5 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-testing:1.72.6_local43316f900242
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-databind@2.21.2
2.21.7

Open the chart page →

7,390
akto-mini-testing-kafkaakto1.42.13 of 5See more

akto-mini-testing-kafka akto 1.42.1

3 of the 5 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.8.0-3-ubi8adc392d28a1e
jackson-databind@2.16.2
2.18.11
confluentinc/cp-zookeeper:7.8.0-3-ubi85ca5f3269814
jackson-databind@2.16.2
2.18.11
public.ecr.aws/aktosecurity/akto-api-security-mini-testing:improve-testing-performance8e9d15ed71c7
jackson-databind@2.16.1
2.18.11

Open the chart page →

7,061
akto-mrs-runtime-combinedakto0.0.22 of 2See more

akto-mrs-runtime-combined akto 0.0.2

2 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime:1.54.4_localb2b97137aef5
jackson-databind@2.16.1
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
jackson-databind@2.19.0
2.21.7

Open the chart page →

2,132
akto-protectionakto0.1.03 of 4See more

akto-protection akto 0.1.0

3 of the 4 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
aktosecurity/akto-api-protection:localbcd7382c9c1b
jackson-databind@2.16.1
2.18.11
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
jackson-databind@2.13.4.2
2.18.11
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
jackson-databind@2.13.4.2
2.18.11

Open the chart page →

11,995
akto-regional-setupakto1.4.34See more

akto-regional-setup akto 1.4.3

4 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.5.35d4eab1c36b9
jackson-databind@2.18.9
2.18.11
aktosecurity/mini-runtime:1.72.15498e3e35ecc2
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/akto-threat-detection:1.16.2a47eb6cc17ea
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
jackson-databind@2.21.2
2.21.7

Open the chart page →

—
akto-runtimeakto0.1.82 of 2See more

akto-runtime akto 0.1.8

2 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime:latest8b9208c09d76
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-databind@2.21.2
2.21.7

Open the chart page →

1,706
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
aktosecurity/source-code-analyser:a-1703-merge274042ed7a53
jackson-databind@2.16.1
2.18.11

Open the chart page →

5,273
akto-testing-db-layerakto1.42.171 of 2See more

akto-testing-db-layer akto 1.42.17

1 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer:1.74.4_local1ed844ecab29
jackson-databind@2.18.9
2.18.11

Open the chart page →

40,347
akto-threat-backendakto0.1.52 of 2See more

akto-threat-backend akto 0.1.5

2 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
aktosecurity/akto-threat-detection-backend:latestdffb8c3676ef
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-databind@2.21.2
2.21.7

Open the chart page →

1,745
akto-threat-clientakto0.2.02 of 2See more

akto-threat-client akto 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-91777.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-threat-detection:latesta728eb2eaf06
jackson-databind@2.18.9
2.18.11
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jackson-databind@2.21.2
2.21.7

Open the chart page →

1,776

Container images carrying it

1,044 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-91777.

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.