{"schema_version":"2","view":"grouped","data":[{"id":72053,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-xf6p-3g83-j6rw","summary":"CGA-xf6p-3g83-j6rw","evidence":"osv:CGA-xf6p-3g83-j6rw","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xf6p-3g83-j6rw","aliases":["CGA-xf6p-3g83-j6rw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xf6p-3g83-j6rw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:55Z"}]}}],"modified":"2026-10-02T23:01:55.722423744Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42a0efc8-a76f-4a83-85b9-f827ce8a8973","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xf6p-3g83-j6rw","advisory_id":"42a0efc8-a76f-4a83-85b9-f827ce8a8973","event_types":["advisory"],"published_at":"2026-10-26T00:14:03.021265+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:52:54+00:00","detail_url":"/advisories/advisory%3A42a0efc8-a76f-4a83-85b9-f827ce8a8973","group":{"id":"advisory:42a0efc8-a76f-4a83-85b9-f827ce8a8973","revision":1,"primary_event_id":72678,"change":"published","superseded_by":[],"changed":{"id":72678,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-xf6p-3g83-j6rw","summary":"CGA-xf6p-3g83-j6rw","evidence":"osv:CGA-xf6p-3g83-j6rw","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xf6p-3g83-j6rw","aliases":["CGA-xf6p-3g83-j6rw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xf6p-3g83-j6rw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:55Z"}]}}],"modified":"2026-10-02T23:01:55.722423744Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42a0efc8-a76f-4a83-85b9-f827ce8a8973","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xf6p-3g83-j6rw","advisory_id":"42a0efc8-a76f-4a83-85b9-f827ce8a8973","event_types":["advisory"],"published_at":"2026-10-26T00:14:03.021265+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:52:54+00:00","detail_url":"/events/72678"},"members":[{"id":72678,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-xf6p-3g83-j6rw","summary":"CGA-xf6p-3g83-j6rw","evidence":"osv:CGA-xf6p-3g83-j6rw","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xf6p-3g83-j6rw","aliases":["CGA-xf6p-3g83-j6rw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xf6p-3g83-j6rw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:55Z"}]}}],"modified":"2026-10-02T23:01:55.722423744Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42a0efc8-a76f-4a83-85b9-f827ce8a8973","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xf6p-3g83-j6rw","advisory_id":"42a0efc8-a76f-4a83-85b9-f827ce8a8973","event_types":["advisory"],"published_at":"2026-10-26T00:14:03.021265+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:52:54+00:00","detail_url":"/events/72678"}]}},{"id":71919,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-mrjq-c4c6-fxmq","summary":"CGA-mrjq-c4c6-fxmq","evidence":"osv:CGA-mrjq-c4c6-fxmq","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mrjq-c4c6-fxmq","aliases":["CGA-mrjq-c4c6-fxmq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mrjq-c4c6-fxmq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:16:13Z"}]}}],"modified":"2026-10-02T23:01:40.346718505Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fc2fe3a6-5a9a-4084-aec2-48b824be2a35","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mrjq-c4c6-fxmq","advisory_id":"fc2fe3a6-5a9a-4084-aec2-48b824be2a35","event_types":["advisory"],"published_at":"2026-10-25T23:55:16.413635+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:44:24+00:00","detail_url":"/advisories/advisory%3Afc2fe3a6-5a9a-4084-aec2-48b824be2a35","group":{"id":"advisory:fc2fe3a6-5a9a-4084-aec2-48b824be2a35","revision":1,"primary_event_id":72452,"change":"published","superseded_by":[],"changed":{"id":72452,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-mrjq-c4c6-fxmq","summary":"CGA-mrjq-c4c6-fxmq","evidence":"osv:CGA-mrjq-c4c6-fxmq","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mrjq-c4c6-fxmq","aliases":["CGA-mrjq-c4c6-fxmq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mrjq-c4c6-fxmq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:16:13Z"}]}}],"modified":"2026-10-02T23:01:40.346718505Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fc2fe3a6-5a9a-4084-aec2-48b824be2a35","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mrjq-c4c6-fxmq","advisory_id":"fc2fe3a6-5a9a-4084-aec2-48b824be2a35","event_types":["advisory"],"published_at":"2026-10-25T23:55:16.413635+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:44:24+00:00","detail_url":"/events/72452"},"members":[{"id":72452,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-mrjq-c4c6-fxmq","summary":"CGA-mrjq-c4c6-fxmq","evidence":"osv:CGA-mrjq-c4c6-fxmq","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mrjq-c4c6-fxmq","aliases":["CGA-mrjq-c4c6-fxmq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mrjq-c4c6-fxmq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:16:13Z"}]}}],"modified":"2026-10-02T23:01:40.346718505Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fc2fe3a6-5a9a-4084-aec2-48b824be2a35","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mrjq-c4c6-fxmq","advisory_id":"fc2fe3a6-5a9a-4084-aec2-48b824be2a35","event_types":["advisory"],"published_at":"2026-10-25T23:55:16.413635+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:44:24+00:00","detail_url":"/events/72452"}]}},{"id":71916,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-mhcj-h2wq-9r44","summary":"CGA-mhcj-h2wq-9r44","evidence":"osv:CGA-mhcj-h2wq-9r44","products":[{"name":{"value":"opensearch-2-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mhcj-h2wq-9r44","aliases":["CGA-mhcj-h2wq-9r44"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-observability","purl":"pkg:apk/chainguard/opensearch-2-observability?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mhcj-h2wq-9r44.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:04:08Z"}]}}],"modified":"2026-10-02T23:01:39.549420065Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:10402b8c-8e07-4d30-9158-21b6e549a695","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mhcj-h2wq-9r44","advisory_id":"10402b8c-8e07-4d30-9158-21b6e549a695","event_types":["advisory"],"published_at":"2026-10-25T23:55:01.805601+00:00","technologies":["core-osv","opensearch-2-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:18:42+00:00","detail_url":"/advisories/advisory%3A10402b8c-8e07-4d30-9158-21b6e549a695","group":{"id":"advisory:10402b8c-8e07-4d30-9158-21b6e549a695","revision":1,"primary_event_id":72449,"change":"published","superseded_by":[],"changed":{"id":72449,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-mhcj-h2wq-9r44","summary":"CGA-mhcj-h2wq-9r44","evidence":"osv:CGA-mhcj-h2wq-9r44","products":[{"name":{"value":"opensearch-2-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mhcj-h2wq-9r44","aliases":["CGA-mhcj-h2wq-9r44"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-observability","purl":"pkg:apk/chainguard/opensearch-2-observability?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mhcj-h2wq-9r44.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:04:08Z"}]}}],"modified":"2026-10-02T23:01:39.549420065Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:10402b8c-8e07-4d30-9158-21b6e549a695","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mhcj-h2wq-9r44","advisory_id":"10402b8c-8e07-4d30-9158-21b6e549a695","event_types":["advisory"],"published_at":"2026-10-25T23:55:01.805601+00:00","technologies":["core-osv","opensearch-2-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:18:42+00:00","detail_url":"/events/72449"},"members":[{"id":72449,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-mhcj-h2wq-9r44","summary":"CGA-mhcj-h2wq-9r44","evidence":"osv:CGA-mhcj-h2wq-9r44","products":[{"name":{"value":"opensearch-2-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mhcj-h2wq-9r44","aliases":["CGA-mhcj-h2wq-9r44"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-observability","purl":"pkg:apk/chainguard/opensearch-2-observability?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mhcj-h2wq-9r44.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:04:08Z"}]}}],"modified":"2026-10-02T23:01:39.549420065Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:10402b8c-8e07-4d30-9158-21b6e549a695","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mhcj-h2wq-9r44","advisory_id":"10402b8c-8e07-4d30-9158-21b6e549a695","event_types":["advisory"],"published_at":"2026-10-25T23:55:01.805601+00:00","technologies":["core-osv","opensearch-2-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:18:42+00:00","detail_url":"/events/72449"}]}},{"id":71894,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-mjf7-f5qh-p5j3","summary":"CGA-mjf7-f5qh-p5j3","evidence":"osv:CGA-mjf7-f5qh-p5j3","products":[{"name":{"value":"logstash-fips-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mjf7-f5qh-p5j3","aliases":["CGA-mjf7-f5qh-p5j3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-fips-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mjf7-f5qh-p5j3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:41:42Z"}]}}],"modified":"2026-10-02T23:01:38.556394147Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d7615aed-d80f-4641-8508-66cb4d70d704","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mjf7-f5qh-p5j3","advisory_id":"d7615aed-d80f-4641-8508-66cb4d70d704","event_types":["advisory"],"published_at":"2026-10-25T23:49:17.751505+00:00","technologies":["core-osv","logstash-fips-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:24:47+00:00","detail_url":"/advisories/advisory%3Ad7615aed-d80f-4641-8508-66cb4d70d704","group":{"id":"advisory:d7615aed-d80f-4641-8508-66cb4d70d704","revision":1,"primary_event_id":72410,"change":"published","superseded_by":[],"changed":{"id":72410,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-mjf7-f5qh-p5j3","summary":"CGA-mjf7-f5qh-p5j3","evidence":"osv:CGA-mjf7-f5qh-p5j3","products":[{"name":{"value":"logstash-fips-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mjf7-f5qh-p5j3","aliases":["CGA-mjf7-f5qh-p5j3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-fips-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mjf7-f5qh-p5j3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:41:42Z"}]}}],"modified":"2026-10-02T23:01:38.556394147Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d7615aed-d80f-4641-8508-66cb4d70d704","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mjf7-f5qh-p5j3","advisory_id":"d7615aed-d80f-4641-8508-66cb4d70d704","event_types":["advisory"],"published_at":"2026-10-25T23:49:17.751505+00:00","technologies":["core-osv","logstash-fips-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:24:47+00:00","detail_url":"/events/72410"},"members":[{"id":72410,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-mjf7-f5qh-p5j3","summary":"CGA-mjf7-f5qh-p5j3","evidence":"osv:CGA-mjf7-f5qh-p5j3","products":[{"name":{"value":"logstash-fips-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mjf7-f5qh-p5j3","aliases":["CGA-mjf7-f5qh-p5j3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-fips-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mjf7-f5qh-p5j3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:41:42Z"}]}}],"modified":"2026-10-02T23:01:38.556394147Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d7615aed-d80f-4641-8508-66cb4d70d704","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mjf7-f5qh-p5j3","advisory_id":"d7615aed-d80f-4641-8508-66cb4d70d704","event_types":["advisory"],"published_at":"2026-10-25T23:49:17.751505+00:00","technologies":["core-osv","logstash-fips-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:24:47+00:00","detail_url":"/events/72410"}]}},{"id":71872,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-j7m2-m696-c7vr","summary":"CGA-j7m2-m696-c7vr","evidence":"osv:CGA-j7m2-m696-c7vr","products":[{"name":{"value":"opensearch-2-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-j7m2-m696-c7vr","aliases":["CGA-j7m2-m696-c7vr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-crypto-kms","purl":"pkg:apk/chainguard/opensearch-2-crypto-kms?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j7m2-m696-c7vr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:32:59Z"}]}}],"modified":"2026-10-02T23:01:35.479678361Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:50d80595-c3cf-4b11-8873-6621d2ca65b0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j7m2-m696-c7vr","advisory_id":"50d80595-c3cf-4b11-8873-6621d2ca65b0","event_types":["advisory"],"published_at":"2026-10-25T23:46:43.425687+00:00","technologies":["core-osv","opensearch-2-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:23:29+00:00","detail_url":"/advisories/advisory%3A50d80595-c3cf-4b11-8873-6621d2ca65b0","group":{"id":"advisory:50d80595-c3cf-4b11-8873-6621d2ca65b0","revision":1,"primary_event_id":72371,"change":"published","superseded_by":[],"changed":{"id":72371,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-j7m2-m696-c7vr","summary":"CGA-j7m2-m696-c7vr","evidence":"osv:CGA-j7m2-m696-c7vr","products":[{"name":{"value":"opensearch-2-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-j7m2-m696-c7vr","aliases":["CGA-j7m2-m696-c7vr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-crypto-kms","purl":"pkg:apk/chainguard/opensearch-2-crypto-kms?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j7m2-m696-c7vr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:32:59Z"}]}}],"modified":"2026-10-02T23:01:35.479678361Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:50d80595-c3cf-4b11-8873-6621d2ca65b0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j7m2-m696-c7vr","advisory_id":"50d80595-c3cf-4b11-8873-6621d2ca65b0","event_types":["advisory"],"published_at":"2026-10-25T23:46:43.425687+00:00","technologies":["core-osv","opensearch-2-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:23:29+00:00","detail_url":"/events/72371"},"members":[{"id":72371,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-j7m2-m696-c7vr","summary":"CGA-j7m2-m696-c7vr","evidence":"osv:CGA-j7m2-m696-c7vr","products":[{"name":{"value":"opensearch-2-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-j7m2-m696-c7vr","aliases":["CGA-j7m2-m696-c7vr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-crypto-kms","purl":"pkg:apk/chainguard/opensearch-2-crypto-kms?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j7m2-m696-c7vr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:32:59Z"}]}}],"modified":"2026-10-02T23:01:35.479678361Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:50d80595-c3cf-4b11-8873-6621d2ca65b0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j7m2-m696-c7vr","advisory_id":"50d80595-c3cf-4b11-8873-6621d2ca65b0","event_types":["advisory"],"published_at":"2026-10-25T23:46:43.425687+00:00","technologies":["core-osv","opensearch-2-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:23:29+00:00","detail_url":"/events/72371"}]}},{"id":71833,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gwjh-9v8p-5xfw","summary":"CGA-gwjh-9v8p-5xfw","evidence":"osv:CGA-gwjh-9v8p-5xfw","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gwjh-9v8p-5xfw","aliases":["CGA-gwjh-9v8p-5xfw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gwjh-9v8p-5xfw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:10Z"}]}}],"modified":"2026-10-02T23:01:31.566532361Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0b9359dd-a31b-4985-8d47-05f526b47f3c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gwjh-9v8p-5xfw","advisory_id":"0b9359dd-a31b-4985-8d47-05f526b47f3c","event_types":["advisory"],"published_at":"2026-10-25T23:42:12.818511+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:20+00:00","detail_url":"/advisories/advisory%3A0b9359dd-a31b-4985-8d47-05f526b47f3c","group":{"id":"advisory:0b9359dd-a31b-4985-8d47-05f526b47f3c","revision":1,"primary_event_id":72312,"change":"published","superseded_by":[],"changed":{"id":72312,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gwjh-9v8p-5xfw","summary":"CGA-gwjh-9v8p-5xfw","evidence":"osv:CGA-gwjh-9v8p-5xfw","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gwjh-9v8p-5xfw","aliases":["CGA-gwjh-9v8p-5xfw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gwjh-9v8p-5xfw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:10Z"}]}}],"modified":"2026-10-02T23:01:31.566532361Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0b9359dd-a31b-4985-8d47-05f526b47f3c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gwjh-9v8p-5xfw","advisory_id":"0b9359dd-a31b-4985-8d47-05f526b47f3c","event_types":["advisory"],"published_at":"2026-10-25T23:42:12.818511+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:20+00:00","detail_url":"/events/72312"},"members":[{"id":72312,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gwjh-9v8p-5xfw","summary":"CGA-gwjh-9v8p-5xfw","evidence":"osv:CGA-gwjh-9v8p-5xfw","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gwjh-9v8p-5xfw","aliases":["CGA-gwjh-9v8p-5xfw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gwjh-9v8p-5xfw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:10Z"}]}}],"modified":"2026-10-02T23:01:31.566532361Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0b9359dd-a31b-4985-8d47-05f526b47f3c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gwjh-9v8p-5xfw","advisory_id":"0b9359dd-a31b-4985-8d47-05f526b47f3c","event_types":["advisory"],"published_at":"2026-10-25T23:42:12.818511+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:20+00:00","detail_url":"/events/72312"}]}},{"id":71831,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gh6r-3qpp-87cw","summary":"CGA-gh6r-3qpp-87cw","evidence":"osv:CGA-gh6r-3qpp-87cw","products":[{"name":{"value":"datahub-gms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.0.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gh6r-3qpp-87cw","aliases":["CGA-gh6r-3qpp-87cw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-r1"}]}],"package":{"name":"datahub-gms","purl":"pkg:apk/chainguard/datahub-gms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gh6r-3qpp-87cw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/datahub/datahub-gms/bin/war.war","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:32:07Z"}]}}],"modified":"2026-10-02T23:01:31.538516301Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:60f06df7-7946-4f05-8e91-473f76e7a32f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gh6r-3qpp-87cw","advisory_id":"60f06df7-7946-4f05-8e91-473f76e7a32f","event_types":["advisory"],"published_at":"2026-10-25T23:42:03.165318+00:00","technologies":["core-osv","datahub-gms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:03:56+00:00","detail_url":"/advisories/advisory%3A60f06df7-7946-4f05-8e91-473f76e7a32f","group":{"id":"advisory:60f06df7-7946-4f05-8e91-473f76e7a32f","revision":1,"primary_event_id":72310,"change":"published","superseded_by":[],"changed":{"id":72310,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gh6r-3qpp-87cw","summary":"CGA-gh6r-3qpp-87cw","evidence":"osv:CGA-gh6r-3qpp-87cw","products":[{"name":{"value":"datahub-gms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.0.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gh6r-3qpp-87cw","aliases":["CGA-gh6r-3qpp-87cw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-r1"}]}],"package":{"name":"datahub-gms","purl":"pkg:apk/chainguard/datahub-gms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gh6r-3qpp-87cw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/datahub/datahub-gms/bin/war.war","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:32:07Z"}]}}],"modified":"2026-10-02T23:01:31.538516301Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:60f06df7-7946-4f05-8e91-473f76e7a32f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gh6r-3qpp-87cw","advisory_id":"60f06df7-7946-4f05-8e91-473f76e7a32f","event_types":["advisory"],"published_at":"2026-10-25T23:42:03.165318+00:00","technologies":["core-osv","datahub-gms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:03:56+00:00","detail_url":"/events/72310"},"members":[{"id":72310,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gh6r-3qpp-87cw","summary":"CGA-gh6r-3qpp-87cw","evidence":"osv:CGA-gh6r-3qpp-87cw","products":[{"name":{"value":"datahub-gms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.0.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gh6r-3qpp-87cw","aliases":["CGA-gh6r-3qpp-87cw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-r1"}]}],"package":{"name":"datahub-gms","purl":"pkg:apk/chainguard/datahub-gms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gh6r-3qpp-87cw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/datahub/datahub-gms/bin/war.war","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:32:07Z"}]}}],"modified":"2026-10-02T23:01:31.538516301Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:60f06df7-7946-4f05-8e91-473f76e7a32f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gh6r-3qpp-87cw","advisory_id":"60f06df7-7946-4f05-8e91-473f76e7a32f","event_types":["advisory"],"published_at":"2026-10-25T23:42:03.165318+00:00","technologies":["core-osv","datahub-gms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:03:56+00:00","detail_url":"/events/72310"}]}},{"id":71830,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gjrh-6gxm-65cq","summary":"CGA-gjrh-6gxm-65cq","evidence":"osv:CGA-gjrh-6gxm-65cq","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gjrh-6gxm-65cq","aliases":["CGA-gjrh-6gxm-65cq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gjrh-6gxm-65cq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:13Z"}]}}],"modified":"2026-10-02T23:01:31.537567190Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c0b0d1f2-8b6b-49d3-9680-beaf523ce575","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gjrh-6gxm-65cq","advisory_id":"c0b0d1f2-8b6b-49d3-9680-beaf523ce575","event_types":["advisory"],"published_at":"2026-10-25T23:42:00.803124+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:35:53+00:00","detail_url":"/advisories/advisory%3Ac0b0d1f2-8b6b-49d3-9680-beaf523ce575","group":{"id":"advisory:c0b0d1f2-8b6b-49d3-9680-beaf523ce575","revision":1,"primary_event_id":72309,"change":"published","superseded_by":[],"changed":{"id":72309,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gjrh-6gxm-65cq","summary":"CGA-gjrh-6gxm-65cq","evidence":"osv:CGA-gjrh-6gxm-65cq","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gjrh-6gxm-65cq","aliases":["CGA-gjrh-6gxm-65cq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gjrh-6gxm-65cq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:13Z"}]}}],"modified":"2026-10-02T23:01:31.537567190Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c0b0d1f2-8b6b-49d3-9680-beaf523ce575","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gjrh-6gxm-65cq","advisory_id":"c0b0d1f2-8b6b-49d3-9680-beaf523ce575","event_types":["advisory"],"published_at":"2026-10-25T23:42:00.803124+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:35:53+00:00","detail_url":"/events/72309"},"members":[{"id":72309,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gjrh-6gxm-65cq","summary":"CGA-gjrh-6gxm-65cq","evidence":"osv:CGA-gjrh-6gxm-65cq","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gjrh-6gxm-65cq","aliases":["CGA-gjrh-6gxm-65cq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gjrh-6gxm-65cq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:13Z"}]}}],"modified":"2026-10-02T23:01:31.537567190Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c0b0d1f2-8b6b-49d3-9680-beaf523ce575","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gjrh-6gxm-65cq","advisory_id":"c0b0d1f2-8b6b-49d3-9680-beaf523ce575","event_types":["advisory"],"published_at":"2026-10-25T23:42:00.803124+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:35:53+00:00","detail_url":"/events/72309"}]}},{"id":71771,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-76gx-66cg-h949","summary":"CGA-76gx-66cg-h949","evidence":"osv:CGA-76gx-66cg-h949","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-76gx-66cg-h949","aliases":["CGA-76gx-66cg-h949"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-76gx-66cg-h949.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:16:13Z"}]}}],"modified":"2026-10-02T23:01:26.321897086Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:443a6f22-f273-4476-86fa-848b645ede9e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-76gx-66cg-h949","advisory_id":"443a6f22-f273-4476-86fa-848b645ede9e","event_types":["advisory"],"published_at":"2026-10-25T23:36:24.946553+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:44:22+00:00","detail_url":"/advisories/advisory%3A443a6f22-f273-4476-86fa-848b645ede9e","group":{"id":"advisory:443a6f22-f273-4476-86fa-848b645ede9e","revision":1,"primary_event_id":72231,"change":"published","superseded_by":[],"changed":{"id":72231,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-76gx-66cg-h949","summary":"CGA-76gx-66cg-h949","evidence":"osv:CGA-76gx-66cg-h949","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-76gx-66cg-h949","aliases":["CGA-76gx-66cg-h949"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-76gx-66cg-h949.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:16:13Z"}]}}],"modified":"2026-10-02T23:01:26.321897086Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:443a6f22-f273-4476-86fa-848b645ede9e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-76gx-66cg-h949","advisory_id":"443a6f22-f273-4476-86fa-848b645ede9e","event_types":["advisory"],"published_at":"2026-10-25T23:36:24.946553+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:44:22+00:00","detail_url":"/events/72231"},"members":[{"id":72231,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-76gx-66cg-h949","summary":"CGA-76gx-66cg-h949","evidence":"osv:CGA-76gx-66cg-h949","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-76gx-66cg-h949","aliases":["CGA-76gx-66cg-h949"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-76gx-66cg-h949.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:16:13Z"}]}}],"modified":"2026-10-02T23:01:26.321897086Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:443a6f22-f273-4476-86fa-848b645ede9e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-76gx-66cg-h949","advisory_id":"443a6f22-f273-4476-86fa-848b645ede9e","event_types":["advisory"],"published_at":"2026-10-25T23:36:24.946553+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:44:22+00:00","detail_url":"/events/72231"}]}},{"id":71751,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-4vc9-822r-h769","summary":"CGA-4vc9-822r-h769","evidence":"osv:CGA-4vc9-822r-h769","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4vc9-822r-h769","aliases":["CGA-4vc9-822r-h769"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4vc9-822r-h769.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:12Z"}]}}],"modified":"2026-10-02T23:01:23.555627575Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ddb2ad50-e8d8-4171-944c-dd5c3a71b3f6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4vc9-822r-h769","advisory_id":"ddb2ad50-e8d8-4171-944c-dd5c3a71b3f6","event_types":["advisory"],"published_at":"2026-10-25T23:34:29.892744+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:35:53+00:00","detail_url":"/advisories/advisory%3Addb2ad50-e8d8-4171-944c-dd5c3a71b3f6","group":{"id":"advisory:ddb2ad50-e8d8-4171-944c-dd5c3a71b3f6","revision":1,"primary_event_id":72198,"change":"published","superseded_by":[],"changed":{"id":72198,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-4vc9-822r-h769","summary":"CGA-4vc9-822r-h769","evidence":"osv:CGA-4vc9-822r-h769","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4vc9-822r-h769","aliases":["CGA-4vc9-822r-h769"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4vc9-822r-h769.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:12Z"}]}}],"modified":"2026-10-02T23:01:23.555627575Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ddb2ad50-e8d8-4171-944c-dd5c3a71b3f6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4vc9-822r-h769","advisory_id":"ddb2ad50-e8d8-4171-944c-dd5c3a71b3f6","event_types":["advisory"],"published_at":"2026-10-25T23:34:29.892744+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:35:53+00:00","detail_url":"/events/72198"},"members":[{"id":72198,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-4vc9-822r-h769","summary":"CGA-4vc9-822r-h769","evidence":"osv:CGA-4vc9-822r-h769","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4vc9-822r-h769","aliases":["CGA-4vc9-822r-h769"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4vc9-822r-h769.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:12Z"}]}}],"modified":"2026-10-02T23:01:23.555627575Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ddb2ad50-e8d8-4171-944c-dd5c3a71b3f6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4vc9-822r-h769","advisory_id":"ddb2ad50-e8d8-4171-944c-dd5c3a71b3f6","event_types":["advisory"],"published_at":"2026-10-25T23:34:29.892744+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:35:53+00:00","detail_url":"/events/72198"}]}},{"id":71740,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-4r49-g457-m5fw","summary":"CGA-4r49-g457-m5fw","evidence":"osv:CGA-4r49-g457-m5fw","products":[{"name":{"value":"opensearch-2-reporting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4r49-g457-m5fw","aliases":["CGA-4r49-g457-m5fw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-reporting","purl":"pkg:apk/chainguard/opensearch-2-reporting?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4r49-g457-m5fw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:50:08Z"}]}}],"modified":"2026-10-02T23:01:22.161399094Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0a15b2d6-0435-4646-9e8c-2694e066937a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4r49-g457-m5fw","advisory_id":"0a15b2d6-0435-4646-9e8c-2694e066937a","event_types":["advisory"],"published_at":"2026-10-25T23:33:52.514909+00:00","technologies":["core-osv","opensearch-2-reporting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:51:20+00:00","detail_url":"/advisories/advisory%3A0a15b2d6-0435-4646-9e8c-2694e066937a","group":{"id":"advisory:0a15b2d6-0435-4646-9e8c-2694e066937a","revision":1,"primary_event_id":72185,"change":"published","superseded_by":[],"changed":{"id":72185,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-4r49-g457-m5fw","summary":"CGA-4r49-g457-m5fw","evidence":"osv:CGA-4r49-g457-m5fw","products":[{"name":{"value":"opensearch-2-reporting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4r49-g457-m5fw","aliases":["CGA-4r49-g457-m5fw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-reporting","purl":"pkg:apk/chainguard/opensearch-2-reporting?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4r49-g457-m5fw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:50:08Z"}]}}],"modified":"2026-10-02T23:01:22.161399094Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0a15b2d6-0435-4646-9e8c-2694e066937a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4r49-g457-m5fw","advisory_id":"0a15b2d6-0435-4646-9e8c-2694e066937a","event_types":["advisory"],"published_at":"2026-10-25T23:33:52.514909+00:00","technologies":["core-osv","opensearch-2-reporting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:51:20+00:00","detail_url":"/events/72185"},"members":[{"id":72185,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-4r49-g457-m5fw","summary":"CGA-4r49-g457-m5fw","evidence":"osv:CGA-4r49-g457-m5fw","products":[{"name":{"value":"opensearch-2-reporting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4r49-g457-m5fw","aliases":["CGA-4r49-g457-m5fw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-reporting","purl":"pkg:apk/chainguard/opensearch-2-reporting?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4r49-g457-m5fw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:50:08Z"}]}}],"modified":"2026-10-02T23:01:22.161399094Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0a15b2d6-0435-4646-9e8c-2694e066937a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4r49-g457-m5fw","advisory_id":"0a15b2d6-0435-4646-9e8c-2694e066937a","event_types":["advisory"],"published_at":"2026-10-25T23:33:52.514909+00:00","technologies":["core-osv","opensearch-2-reporting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:51:20+00:00","detail_url":"/events/72185"}]}},{"id":71713,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-cf35-hrv9-vfqh","summary":"CGA-cf35-hrv9-vfqh","evidence":"osv:CGA-cf35-hrv9-vfqh","products":[{"name":{"value":"datahub-gms-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.0.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cf35-hrv9-vfqh","aliases":["CGA-cf35-hrv9-vfqh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-r1"}]}],"package":{"name":"datahub-gms-fips","purl":"pkg:apk/chainguard/datahub-gms-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf35-hrv9-vfqh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/datahub/datahub-gms/bin/war.war","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:51:07Z"}]}}],"modified":"2026-10-02T23:01:20.370593159Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9a671a22-cb36-4e42-8f26-9d0096d4e052","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cf35-hrv9-vfqh","advisory_id":"9a671a22-cb36-4e42-8f26-9d0096d4e052","event_types":["advisory"],"published_at":"2026-10-25T23:31:30.957894+00:00","technologies":["core-osv","datahub-gms-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:23:59+00:00","detail_url":"/advisories/advisory%3A9a671a22-cb36-4e42-8f26-9d0096d4e052","group":{"id":"advisory:9a671a22-cb36-4e42-8f26-9d0096d4e052","revision":1,"primary_event_id":72157,"change":"published","superseded_by":[],"changed":{"id":72157,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-cf35-hrv9-vfqh","summary":"CGA-cf35-hrv9-vfqh","evidence":"osv:CGA-cf35-hrv9-vfqh","products":[{"name":{"value":"datahub-gms-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.0.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cf35-hrv9-vfqh","aliases":["CGA-cf35-hrv9-vfqh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-r1"}]}],"package":{"name":"datahub-gms-fips","purl":"pkg:apk/chainguard/datahub-gms-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf35-hrv9-vfqh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/datahub/datahub-gms/bin/war.war","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:51:07Z"}]}}],"modified":"2026-10-02T23:01:20.370593159Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9a671a22-cb36-4e42-8f26-9d0096d4e052","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cf35-hrv9-vfqh","advisory_id":"9a671a22-cb36-4e42-8f26-9d0096d4e052","event_types":["advisory"],"published_at":"2026-10-25T23:31:30.957894+00:00","technologies":["core-osv","datahub-gms-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:23:59+00:00","detail_url":"/events/72157"},"members":[{"id":72157,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-cf35-hrv9-vfqh","summary":"CGA-cf35-hrv9-vfqh","evidence":"osv:CGA-cf35-hrv9-vfqh","products":[{"name":{"value":"datahub-gms-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.0.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cf35-hrv9-vfqh","aliases":["CGA-cf35-hrv9-vfqh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-r1"}]}],"package":{"name":"datahub-gms-fips","purl":"pkg:apk/chainguard/datahub-gms-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf35-hrv9-vfqh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/datahub/datahub-gms/bin/war.war","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:51:07Z"}]}}],"modified":"2026-10-02T23:01:20.370593159Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9a671a22-cb36-4e42-8f26-9d0096d4e052","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cf35-hrv9-vfqh","advisory_id":"9a671a22-cb36-4e42-8f26-9d0096d4e052","event_types":["advisory"],"published_at":"2026-10-25T23:31:30.957894+00:00","technologies":["core-osv","datahub-gms-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:23:59+00:00","detail_url":"/events/72157"}]}},{"id":71701,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-7p4v-whpj-68cf","summary":"CGA-7p4v-whpj-68cf","evidence":"osv:CGA-7p4v-whpj-68cf","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7p4v-whpj-68cf","aliases":["CGA-7p4v-whpj-68cf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7p4v-whpj-68cf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:55Z"}]}}],"modified":"2026-10-02T23:01:18.655741451Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f88c5032-a8be-49a8-82bc-3766e80d9965","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7p4v-whpj-68cf","advisory_id":"f88c5032-a8be-49a8-82bc-3766e80d9965","event_types":["advisory"],"published_at":"2026-10-25T23:30:23.001234+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:52:55+00:00","detail_url":"/advisories/advisory%3Af88c5032-a8be-49a8-82bc-3766e80d9965","group":{"id":"advisory:f88c5032-a8be-49a8-82bc-3766e80d9965","revision":1,"primary_event_id":72141,"change":"published","superseded_by":[],"changed":{"id":72141,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-7p4v-whpj-68cf","summary":"CGA-7p4v-whpj-68cf","evidence":"osv:CGA-7p4v-whpj-68cf","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7p4v-whpj-68cf","aliases":["CGA-7p4v-whpj-68cf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7p4v-whpj-68cf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:55Z"}]}}],"modified":"2026-10-02T23:01:18.655741451Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f88c5032-a8be-49a8-82bc-3766e80d9965","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7p4v-whpj-68cf","advisory_id":"f88c5032-a8be-49a8-82bc-3766e80d9965","event_types":["advisory"],"published_at":"2026-10-25T23:30:23.001234+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:52:55+00:00","detail_url":"/events/72141"},"members":[{"id":72141,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-7p4v-whpj-68cf","summary":"CGA-7p4v-whpj-68cf","evidence":"osv:CGA-7p4v-whpj-68cf","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7p4v-whpj-68cf","aliases":["CGA-7p4v-whpj-68cf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7p4v-whpj-68cf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:55Z"}]}}],"modified":"2026-10-02T23:01:18.655741451Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f88c5032-a8be-49a8-82bc-3766e80d9965","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7p4v-whpj-68cf","advisory_id":"f88c5032-a8be-49a8-82bc-3766e80d9965","event_types":["advisory"],"published_at":"2026-10-25T23:30:23.001234+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:52:55+00:00","detail_url":"/events/72141"}]}},{"id":71649,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-wh3w-7mvx-q5j6","summary":"CGA-wh3w-7mvx-q5j6","evidence":"osv:CGA-wh3w-7mvx-q5j6","products":[{"name":{"value":"opensearch-2-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wh3w-7mvx-q5j6","aliases":["CGA-wh3w-7mvx-q5j6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-crypto-kms","purl":"pkg:apk/chainguard/opensearch-2-crypto-kms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh3w-7mvx-q5j6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:02:09Z"}]}}],"modified":"2026-10-02T23:01:14.400485320Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:40f26d5d-2f3c-46e8-9e6c-61b3d1e76b03","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh3w-7mvx-q5j6","advisory_id":"40f26d5d-2f3c-46e8-9e6c-61b3d1e76b03","event_types":["advisory"],"published_at":"2026-10-25T23:26:04.974938+00:00","technologies":["core-osv","opensearch-2-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:26:17+00:00","detail_url":"/advisories/advisory%3A40f26d5d-2f3c-46e8-9e6c-61b3d1e76b03","group":{"id":"advisory:40f26d5d-2f3c-46e8-9e6c-61b3d1e76b03","revision":1,"primary_event_id":72082,"change":"published","superseded_by":[],"changed":{"id":72082,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-wh3w-7mvx-q5j6","summary":"CGA-wh3w-7mvx-q5j6","evidence":"osv:CGA-wh3w-7mvx-q5j6","products":[{"name":{"value":"opensearch-2-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wh3w-7mvx-q5j6","aliases":["CGA-wh3w-7mvx-q5j6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-crypto-kms","purl":"pkg:apk/chainguard/opensearch-2-crypto-kms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh3w-7mvx-q5j6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:02:09Z"}]}}],"modified":"2026-10-02T23:01:14.400485320Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:40f26d5d-2f3c-46e8-9e6c-61b3d1e76b03","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh3w-7mvx-q5j6","advisory_id":"40f26d5d-2f3c-46e8-9e6c-61b3d1e76b03","event_types":["advisory"],"published_at":"2026-10-25T23:26:04.974938+00:00","technologies":["core-osv","opensearch-2-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:26:17+00:00","detail_url":"/events/72082"},"members":[{"id":72082,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-wh3w-7mvx-q5j6","summary":"CGA-wh3w-7mvx-q5j6","evidence":"osv:CGA-wh3w-7mvx-q5j6","products":[{"name":{"value":"opensearch-2-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wh3w-7mvx-q5j6","aliases":["CGA-wh3w-7mvx-q5j6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-crypto-kms","purl":"pkg:apk/chainguard/opensearch-2-crypto-kms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh3w-7mvx-q5j6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:02:09Z"}]}}],"modified":"2026-10-02T23:01:14.400485320Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:40f26d5d-2f3c-46e8-9e6c-61b3d1e76b03","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh3w-7mvx-q5j6","advisory_id":"40f26d5d-2f3c-46e8-9e6c-61b3d1e76b03","event_types":["advisory"],"published_at":"2026-10-25T23:26:04.974938+00:00","technologies":["core-osv","opensearch-2-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:26:17+00:00","detail_url":"/events/72082"}]}},{"id":71629,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-r64v-p232-8j34","summary":"CGA-r64v-p232-8j34","evidence":"osv:CGA-r64v-p232-8j34","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-r64v-p232-8j34","aliases":["CGA-r64v-p232-8j34"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r64v-p232-8j34.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:52:58Z"}]}}],"modified":"2026-10-02T23:01:12.483134841Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:496a9e19-e2a0-46fd-8d20-30b1f510eca4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r64v-p232-8j34","advisory_id":"496a9e19-e2a0-46fd-8d20-30b1f510eca4","event_types":["advisory"],"published_at":"2026-10-25T23:24:15.328719+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:38:49+00:00","detail_url":"/advisories/advisory%3A496a9e19-e2a0-46fd-8d20-30b1f510eca4","group":{"id":"advisory:496a9e19-e2a0-46fd-8d20-30b1f510eca4","revision":1,"primary_event_id":72058,"change":"published","superseded_by":[],"changed":{"id":72058,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-r64v-p232-8j34","summary":"CGA-r64v-p232-8j34","evidence":"osv:CGA-r64v-p232-8j34","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-r64v-p232-8j34","aliases":["CGA-r64v-p232-8j34"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r64v-p232-8j34.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:52:58Z"}]}}],"modified":"2026-10-02T23:01:12.483134841Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:496a9e19-e2a0-46fd-8d20-30b1f510eca4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r64v-p232-8j34","advisory_id":"496a9e19-e2a0-46fd-8d20-30b1f510eca4","event_types":["advisory"],"published_at":"2026-10-25T23:24:15.328719+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:38:49+00:00","detail_url":"/events/72058"},"members":[{"id":72058,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-r64v-p232-8j34","summary":"CGA-r64v-p232-8j34","evidence":"osv:CGA-r64v-p232-8j34","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-r64v-p232-8j34","aliases":["CGA-r64v-p232-8j34"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r64v-p232-8j34.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:52:58Z"}]}}],"modified":"2026-10-02T23:01:12.483134841Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:496a9e19-e2a0-46fd-8d20-30b1f510eca4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r64v-p232-8j34","advisory_id":"496a9e19-e2a0-46fd-8d20-30b1f510eca4","event_types":["advisory"],"published_at":"2026-10-25T23:24:15.328719+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:38:49+00:00","detail_url":"/events/72058"}]}},{"id":71628,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-r8ch-h8vf-3m56","summary":"CGA-r8ch-h8vf-3m56","evidence":"osv:CGA-r8ch-h8vf-3m56","products":[{"name":{"value":"opensearch-2-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-r8ch-h8vf-3m56","aliases":["CGA-r8ch-h8vf-3m56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-observability","purl":"pkg:apk/chainguard/opensearch-2-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r8ch-h8vf-3m56.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:30:08Z"}]}}],"modified":"2026-10-02T23:01:12.480152700Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3aae0ed9-12fe-42b6-881a-c33572ff470d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r8ch-h8vf-3m56","advisory_id":"3aae0ed9-12fe-42b6-881a-c33572ff470d","event_types":["advisory"],"published_at":"2026-10-25T23:24:11.712552+00:00","technologies":["core-osv","opensearch-2-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:40:08+00:00","detail_url":"/advisories/advisory%3A3aae0ed9-12fe-42b6-881a-c33572ff470d","group":{"id":"advisory:3aae0ed9-12fe-42b6-881a-c33572ff470d","revision":1,"primary_event_id":72057,"change":"published","superseded_by":[],"changed":{"id":72057,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-r8ch-h8vf-3m56","summary":"CGA-r8ch-h8vf-3m56","evidence":"osv:CGA-r8ch-h8vf-3m56","products":[{"name":{"value":"opensearch-2-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-r8ch-h8vf-3m56","aliases":["CGA-r8ch-h8vf-3m56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-observability","purl":"pkg:apk/chainguard/opensearch-2-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r8ch-h8vf-3m56.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:30:08Z"}]}}],"modified":"2026-10-02T23:01:12.480152700Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3aae0ed9-12fe-42b6-881a-c33572ff470d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r8ch-h8vf-3m56","advisory_id":"3aae0ed9-12fe-42b6-881a-c33572ff470d","event_types":["advisory"],"published_at":"2026-10-25T23:24:11.712552+00:00","technologies":["core-osv","opensearch-2-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:40:08+00:00","detail_url":"/events/72057"},"members":[{"id":72057,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-r8ch-h8vf-3m56","summary":"CGA-r8ch-h8vf-3m56","evidence":"osv:CGA-r8ch-h8vf-3m56","products":[{"name":{"value":"opensearch-2-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-r8ch-h8vf-3m56","aliases":["CGA-r8ch-h8vf-3m56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-observability","purl":"pkg:apk/chainguard/opensearch-2-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r8ch-h8vf-3m56.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:30:08Z"}]}}],"modified":"2026-10-02T23:01:12.480152700Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3aae0ed9-12fe-42b6-881a-c33572ff470d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r8ch-h8vf-3m56","advisory_id":"3aae0ed9-12fe-42b6-881a-c33572ff470d","event_types":["advisory"],"published_at":"2026-10-25T23:24:11.712552+00:00","technologies":["core-osv","opensearch-2-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:40:08+00:00","detail_url":"/events/72057"}]}},{"id":71614,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-pj85-79q6-g8rm","summary":"CGA-pj85-79q6-g8rm","evidence":"osv:CGA-pj85-79q6-g8rm","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pj85-79q6-g8rm","aliases":["CGA-pj85-79q6-g8rm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pj85-79q6-g8rm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:53:11Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pj85-79q6-g8rm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:53:11Z"}]}}],"modified":"2026-10-02T23:01:09.910348200Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2ab386f2-3441-40d5-a768-7c80ca3a067e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pj85-79q6-g8rm","advisory_id":"2ab386f2-3441-40d5-a768-7c80ca3a067e","event_types":["advisory"],"published_at":"2026-10-25T23:23:10.012225+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:23:55+00:00","detail_url":"/advisories/advisory%3A2ab386f2-3441-40d5-a768-7c80ca3a067e","group":{"id":"advisory:2ab386f2-3441-40d5-a768-7c80ca3a067e","revision":1,"primary_event_id":72038,"change":"published","superseded_by":[],"changed":{"id":72038,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-pj85-79q6-g8rm","summary":"CGA-pj85-79q6-g8rm","evidence":"osv:CGA-pj85-79q6-g8rm","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pj85-79q6-g8rm","aliases":["CGA-pj85-79q6-g8rm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pj85-79q6-g8rm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:53:11Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pj85-79q6-g8rm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:53:11Z"}]}}],"modified":"2026-10-02T23:01:09.910348200Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2ab386f2-3441-40d5-a768-7c80ca3a067e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pj85-79q6-g8rm","advisory_id":"2ab386f2-3441-40d5-a768-7c80ca3a067e","event_types":["advisory"],"published_at":"2026-10-25T23:23:10.012225+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:23:55+00:00","detail_url":"/events/72038"},"members":[{"id":72038,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-pj85-79q6-g8rm","summary":"CGA-pj85-79q6-g8rm","evidence":"osv:CGA-pj85-79q6-g8rm","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pj85-79q6-g8rm","aliases":["CGA-pj85-79q6-g8rm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pj85-79q6-g8rm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:53:11Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pj85-79q6-g8rm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:53:11Z"}]}}],"modified":"2026-10-02T23:01:09.910348200Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2ab386f2-3441-40d5-a768-7c80ca3a067e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pj85-79q6-g8rm","advisory_id":"2ab386f2-3441-40d5-a768-7c80ca3a067e","event_types":["advisory"],"published_at":"2026-10-25T23:23:10.012225+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:23:55+00:00","detail_url":"/events/72038"}]}},{"id":71599,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-h2cr-v4jc-q7mh","summary":"CGA-h2cr-v4jc-q7mh","evidence":"osv:CGA-h2cr-v4jc-q7mh","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-h2cr-v4jc-q7mh","aliases":["CGA-h2cr-v4jc-q7mh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h2cr-v4jc-q7mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:15Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h2cr-v4jc-q7mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:15Z"}]}}],"modified":"2026-10-02T23:01:08.342834596Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9a2fbcf9-80c4-4daf-bafd-1e374c1c4d0d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h2cr-v4jc-q7mh","advisory_id":"9a2fbcf9-80c4-4daf-bafd-1e374c1c4d0d","event_types":["advisory"],"published_at":"2026-10-25T23:21:59.18869+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:11:42+00:00","detail_url":"/advisories/advisory%3A9a2fbcf9-80c4-4daf-bafd-1e374c1c4d0d","group":{"id":"advisory:9a2fbcf9-80c4-4daf-bafd-1e374c1c4d0d","revision":1,"primary_event_id":72018,"change":"published","superseded_by":[],"changed":{"id":72018,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-h2cr-v4jc-q7mh","summary":"CGA-h2cr-v4jc-q7mh","evidence":"osv:CGA-h2cr-v4jc-q7mh","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-h2cr-v4jc-q7mh","aliases":["CGA-h2cr-v4jc-q7mh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h2cr-v4jc-q7mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:15Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h2cr-v4jc-q7mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:15Z"}]}}],"modified":"2026-10-02T23:01:08.342834596Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9a2fbcf9-80c4-4daf-bafd-1e374c1c4d0d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h2cr-v4jc-q7mh","advisory_id":"9a2fbcf9-80c4-4daf-bafd-1e374c1c4d0d","event_types":["advisory"],"published_at":"2026-10-25T23:21:59.18869+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:11:42+00:00","detail_url":"/events/72018"},"members":[{"id":72018,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-h2cr-v4jc-q7mh","summary":"CGA-h2cr-v4jc-q7mh","evidence":"osv:CGA-h2cr-v4jc-q7mh","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-h2cr-v4jc-q7mh","aliases":["CGA-h2cr-v4jc-q7mh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h2cr-v4jc-q7mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:15Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h2cr-v4jc-q7mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:15Z"}]}}],"modified":"2026-10-02T23:01:08.342834596Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9a2fbcf9-80c4-4daf-bafd-1e374c1c4d0d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h2cr-v4jc-q7mh","advisory_id":"9a2fbcf9-80c4-4daf-bafd-1e374c1c4d0d","event_types":["advisory"],"published_at":"2026-10-25T23:21:59.18869+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:11:42+00:00","detail_url":"/events/72018"}]}},{"id":71598,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-8858-x8w9-vj59","summary":"CGA-8858-x8w9-vj59","evidence":"osv:CGA-8858-x8w9-vj59","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8858-x8w9-vj59","aliases":["CGA-8858-x8w9-vj59"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8858-x8w9-vj59.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:09Z"}]}}],"modified":"2026-10-02T23:01:08.342449802Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7f42ccb8-abbf-489c-b52e-8f9accf2dccc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8858-x8w9-vj59","advisory_id":"7f42ccb8-abbf-489c-b52e-8f9accf2dccc","event_types":["advisory"],"published_at":"2026-10-25T23:21:57.722459+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:17+00:00","detail_url":"/advisories/advisory%3A7f42ccb8-abbf-489c-b52e-8f9accf2dccc","group":{"id":"advisory:7f42ccb8-abbf-489c-b52e-8f9accf2dccc","revision":1,"primary_event_id":72017,"change":"published","superseded_by":[],"changed":{"id":72017,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-8858-x8w9-vj59","summary":"CGA-8858-x8w9-vj59","evidence":"osv:CGA-8858-x8w9-vj59","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8858-x8w9-vj59","aliases":["CGA-8858-x8w9-vj59"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8858-x8w9-vj59.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:09Z"}]}}],"modified":"2026-10-02T23:01:08.342449802Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7f42ccb8-abbf-489c-b52e-8f9accf2dccc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8858-x8w9-vj59","advisory_id":"7f42ccb8-abbf-489c-b52e-8f9accf2dccc","event_types":["advisory"],"published_at":"2026-10-25T23:21:57.722459+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:17+00:00","detail_url":"/events/72017"},"members":[{"id":72017,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-8858-x8w9-vj59","summary":"CGA-8858-x8w9-vj59","evidence":"osv:CGA-8858-x8w9-vj59","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8858-x8w9-vj59","aliases":["CGA-8858-x8w9-vj59"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8858-x8w9-vj59.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:09Z"}]}}],"modified":"2026-10-02T23:01:08.342449802Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7f42ccb8-abbf-489c-b52e-8f9accf2dccc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8858-x8w9-vj59","advisory_id":"7f42ccb8-abbf-489c-b52e-8f9accf2dccc","event_types":["advisory"],"published_at":"2026-10-25T23:21:57.722459+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:17+00:00","detail_url":"/events/72017"}]}},{"id":71574,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-622r-2q6r-wrw5","summary":"CGA-622r-2q6r-wrw5","evidence":"osv:CGA-622r-2q6r-wrw5","products":[{"name":{"value":"opensearch-2-reporting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-622r-2q6r-wrw5","aliases":["CGA-622r-2q6r-wrw5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-reporting","purl":"pkg:apk/chainguard/opensearch-2-reporting?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-622r-2q6r-wrw5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:32:59Z"}]}}],"modified":"2026-10-02T23:01:06.367191574Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1ce9f429-23b5-48e8-b15b-469616324e60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-622r-2q6r-wrw5","advisory_id":"1ce9f429-23b5-48e8-b15b-469616324e60","event_types":["advisory"],"published_at":"2026-10-25T23:20:18.443774+00:00","technologies":["core-osv","opensearch-2-reporting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:24:36+00:00","detail_url":"/advisories/advisory%3A1ce9f429-23b5-48e8-b15b-469616324e60","group":{"id":"advisory:1ce9f429-23b5-48e8-b15b-469616324e60","revision":1,"primary_event_id":71991,"change":"published","superseded_by":[],"changed":{"id":71991,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-622r-2q6r-wrw5","summary":"CGA-622r-2q6r-wrw5","evidence":"osv:CGA-622r-2q6r-wrw5","products":[{"name":{"value":"opensearch-2-reporting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-622r-2q6r-wrw5","aliases":["CGA-622r-2q6r-wrw5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-reporting","purl":"pkg:apk/chainguard/opensearch-2-reporting?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-622r-2q6r-wrw5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:32:59Z"}]}}],"modified":"2026-10-02T23:01:06.367191574Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1ce9f429-23b5-48e8-b15b-469616324e60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-622r-2q6r-wrw5","advisory_id":"1ce9f429-23b5-48e8-b15b-469616324e60","event_types":["advisory"],"published_at":"2026-10-25T23:20:18.443774+00:00","technologies":["core-osv","opensearch-2-reporting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:24:36+00:00","detail_url":"/events/71991"},"members":[{"id":71991,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-622r-2q6r-wrw5","summary":"CGA-622r-2q6r-wrw5","evidence":"osv:CGA-622r-2q6r-wrw5","products":[{"name":{"value":"opensearch-2-reporting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-622r-2q6r-wrw5","aliases":["CGA-622r-2q6r-wrw5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-reporting","purl":"pkg:apk/chainguard/opensearch-2-reporting?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-622r-2q6r-wrw5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-reports-scheduler/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:32:59Z"}]}}],"modified":"2026-10-02T23:01:06.367191574Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1ce9f429-23b5-48e8-b15b-469616324e60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-622r-2q6r-wrw5","advisory_id":"1ce9f429-23b5-48e8-b15b-469616324e60","event_types":["advisory"],"published_at":"2026-10-25T23:20:18.443774+00:00","technologies":["core-osv","opensearch-2-reporting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:24:36+00:00","detail_url":"/events/71991"}]}},{"id":71523,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-xppg-cjw9-289v","summary":"CGA-xppg-cjw9-289v","evidence":"osv:CGA-xppg-cjw9-289v","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xppg-cjw9-289v","aliases":["CGA-xppg-cjw9-289v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xppg-cjw9-289v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:13Z"}]}}],"modified":"2026-10-02T23:01:00.101673334Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2d7cd061-bab6-4432-b29a-9c33927a72fb","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xppg-cjw9-289v","advisory_id":"2d7cd061-bab6-4432-b29a-9c33927a72fb","event_types":["advisory"],"published_at":"2026-10-25T23:16:47.36669+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:35:54+00:00","detail_url":"/advisories/advisory%3A2d7cd061-bab6-4432-b29a-9c33927a72fb","group":{"id":"advisory:2d7cd061-bab6-4432-b29a-9c33927a72fb","revision":1,"primary_event_id":71936,"change":"published","superseded_by":[],"changed":{"id":71936,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-xppg-cjw9-289v","summary":"CGA-xppg-cjw9-289v","evidence":"osv:CGA-xppg-cjw9-289v","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xppg-cjw9-289v","aliases":["CGA-xppg-cjw9-289v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xppg-cjw9-289v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:13Z"}]}}],"modified":"2026-10-02T23:01:00.101673334Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2d7cd061-bab6-4432-b29a-9c33927a72fb","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xppg-cjw9-289v","advisory_id":"2d7cd061-bab6-4432-b29a-9c33927a72fb","event_types":["advisory"],"published_at":"2026-10-25T23:16:47.36669+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:35:54+00:00","detail_url":"/events/71936"},"members":[{"id":71936,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-xppg-cjw9-289v","summary":"CGA-xppg-cjw9-289v","evidence":"osv:CGA-xppg-cjw9-289v","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xppg-cjw9-289v","aliases":["CGA-xppg-cjw9-289v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xppg-cjw9-289v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:13Z"}]}}],"modified":"2026-10-02T23:01:00.101673334Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2d7cd061-bab6-4432-b29a-9c33927a72fb","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xppg-cjw9-289v","advisory_id":"2d7cd061-bab6-4432-b29a-9c33927a72fb","event_types":["advisory"],"published_at":"2026-10-25T23:16:47.36669+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:35:54+00:00","detail_url":"/events/71936"}]}},{"id":71520,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-65mw-gccr-3gfm","summary":"CGA-65mw-gccr-3gfm","evidence":"osv:CGA-65mw-gccr-3gfm","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-65mw-gccr-3gfm","aliases":["CGA-65mw-gccr-3gfm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65mw-gccr-3gfm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:52:57Z"}]}}],"modified":"2026-10-02T23:01:02.309009231Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:28e3b7fe-74b2-479a-917d-35add98a6e28","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-65mw-gccr-3gfm","advisory_id":"28e3b7fe-74b2-479a-917d-35add98a6e28","event_types":["advisory"],"published_at":"2026-10-25T23:16:30.849764+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:38:48+00:00","detail_url":"/advisories/advisory%3A28e3b7fe-74b2-479a-917d-35add98a6e28","group":{"id":"advisory:28e3b7fe-74b2-479a-917d-35add98a6e28","revision":1,"primary_event_id":71931,"change":"published","superseded_by":[],"changed":{"id":71931,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-65mw-gccr-3gfm","summary":"CGA-65mw-gccr-3gfm","evidence":"osv:CGA-65mw-gccr-3gfm","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-65mw-gccr-3gfm","aliases":["CGA-65mw-gccr-3gfm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65mw-gccr-3gfm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:52:57Z"}]}}],"modified":"2026-10-02T23:01:02.309009231Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:28e3b7fe-74b2-479a-917d-35add98a6e28","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-65mw-gccr-3gfm","advisory_id":"28e3b7fe-74b2-479a-917d-35add98a6e28","event_types":["advisory"],"published_at":"2026-10-25T23:16:30.849764+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:38:48+00:00","detail_url":"/events/71931"},"members":[{"id":71931,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-65mw-gccr-3gfm","summary":"CGA-65mw-gccr-3gfm","evidence":"osv:CGA-65mw-gccr-3gfm","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-65mw-gccr-3gfm","aliases":["CGA-65mw-gccr-3gfm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65mw-gccr-3gfm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:52:57Z"}]}}],"modified":"2026-10-02T23:01:02.309009231Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:28e3b7fe-74b2-479a-917d-35add98a6e28","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-65mw-gccr-3gfm","advisory_id":"28e3b7fe-74b2-479a-917d-35add98a6e28","event_types":["advisory"],"published_at":"2026-10-25T23:16:30.849764+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:38:48+00:00","detail_url":"/events/71931"}]}},{"id":71480,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-vr66-rxv4-ch39","summary":"CGA-vr66-rxv4-ch39","evidence":"osv:CGA-vr66-rxv4-ch39","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vr66-rxv4-ch39","aliases":["CGA-vr66-rxv4-ch39"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vr66-rxv4-ch39.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:10Z"}]}}],"modified":"2026-10-02T23:00:58.041360851Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bedc99cb-8f25-4dcc-b831-25660571f756","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vr66-rxv4-ch39","advisory_id":"bedc99cb-8f25-4dcc-b831-25660571f756","event_types":["advisory"],"published_at":"2026-10-25T23:13:25.31152+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:19+00:00","detail_url":"/advisories/advisory%3Abedc99cb-8f25-4dcc-b831-25660571f756","group":{"id":"advisory:bedc99cb-8f25-4dcc-b831-25660571f756","revision":1,"primary_event_id":71887,"change":"published","superseded_by":[],"changed":{"id":71887,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-vr66-rxv4-ch39","summary":"CGA-vr66-rxv4-ch39","evidence":"osv:CGA-vr66-rxv4-ch39","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vr66-rxv4-ch39","aliases":["CGA-vr66-rxv4-ch39"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vr66-rxv4-ch39.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:10Z"}]}}],"modified":"2026-10-02T23:00:58.041360851Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bedc99cb-8f25-4dcc-b831-25660571f756","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vr66-rxv4-ch39","advisory_id":"bedc99cb-8f25-4dcc-b831-25660571f756","event_types":["advisory"],"published_at":"2026-10-25T23:13:25.31152+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:19+00:00","detail_url":"/events/71887"},"members":[{"id":71887,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-vr66-rxv4-ch39","summary":"CGA-vr66-rxv4-ch39","evidence":"osv:CGA-vr66-rxv4-ch39","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vr66-rxv4-ch39","aliases":["CGA-vr66-rxv4-ch39"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vr66-rxv4-ch39.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:10Z"}]}}],"modified":"2026-10-02T23:00:58.041360851Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bedc99cb-8f25-4dcc-b831-25660571f756","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vr66-rxv4-ch39","advisory_id":"bedc99cb-8f25-4dcc-b831-25660571f756","event_types":["advisory"],"published_at":"2026-10-25T23:13:25.31152+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:19+00:00","detail_url":"/events/71887"}]}},{"id":71425,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-hv39-6cv7-8gc9","summary":"CGA-hv39-6cv7-8gc9","evidence":"osv:CGA-hv39-6cv7-8gc9","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-hv39-6cv7-8gc9","aliases":["CGA-hv39-6cv7-8gc9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hv39-6cv7-8gc9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:16:13Z"}]}}],"modified":"2026-10-02T23:00:51.422920668Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b7397805-c1b4-494c-aa1c-b03ab87e7fb0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hv39-6cv7-8gc9","advisory_id":"b7397805-c1b4-494c-aa1c-b03ab87e7fb0","event_types":["advisory"],"published_at":"2026-10-25T23:09:17.319569+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:44:20+00:00","detail_url":"/advisories/advisory%3Ab7397805-c1b4-494c-aa1c-b03ab87e7fb0","group":{"id":"advisory:b7397805-c1b4-494c-aa1c-b03ab87e7fb0","revision":1,"primary_event_id":71821,"change":"published","superseded_by":[],"changed":{"id":71821,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-hv39-6cv7-8gc9","summary":"CGA-hv39-6cv7-8gc9","evidence":"osv:CGA-hv39-6cv7-8gc9","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-hv39-6cv7-8gc9","aliases":["CGA-hv39-6cv7-8gc9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hv39-6cv7-8gc9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:16:13Z"}]}}],"modified":"2026-10-02T23:00:51.422920668Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b7397805-c1b4-494c-aa1c-b03ab87e7fb0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hv39-6cv7-8gc9","advisory_id":"b7397805-c1b4-494c-aa1c-b03ab87e7fb0","event_types":["advisory"],"published_at":"2026-10-25T23:09:17.319569+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:44:20+00:00","detail_url":"/events/71821"},"members":[{"id":71821,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-hv39-6cv7-8gc9","summary":"CGA-hv39-6cv7-8gc9","evidence":"osv:CGA-hv39-6cv7-8gc9","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-hv39-6cv7-8gc9","aliases":["CGA-hv39-6cv7-8gc9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hv39-6cv7-8gc9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:16:13Z"}]}}],"modified":"2026-10-02T23:00:51.422920668Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b7397805-c1b4-494c-aa1c-b03ab87e7fb0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hv39-6cv7-8gc9","advisory_id":"b7397805-c1b4-494c-aa1c-b03ab87e7fb0","event_types":["advisory"],"published_at":"2026-10-25T23:09:17.319569+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:44:20+00:00","detail_url":"/events/71821"}]}},{"id":71407,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gghx-m7px-wjmf","summary":"CGA-gghx-m7px-wjmf","evidence":"osv:CGA-gghx-m7px-wjmf","products":[{"name":{"value":"datahub-gms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.0.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gghx-m7px-wjmf","aliases":["CGA-gghx-m7px-wjmf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-r1"}]}],"package":{"name":"datahub-gms","purl":"pkg:apk/chainguard/datahub-gms?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gghx-m7px-wjmf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/datahub/datahub-gms/bin/war.war","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:36:08Z"}]}}],"modified":"2026-10-02T23:00:49.066806153Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25de85ee-cfcb-4581-9b00-bda7055025be","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gghx-m7px-wjmf","advisory_id":"25de85ee-cfcb-4581-9b00-bda7055025be","event_types":["advisory"],"published_at":"2026-10-25T23:08:08.32433+00:00","technologies":["core-osv","datahub-gms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T11:37:48+00:00","detail_url":"/advisories/advisory%3A25de85ee-cfcb-4581-9b00-bda7055025be","group":{"id":"advisory:25de85ee-cfcb-4581-9b00-bda7055025be","revision":1,"primary_event_id":71798,"change":"published","superseded_by":[],"changed":{"id":71798,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gghx-m7px-wjmf","summary":"CGA-gghx-m7px-wjmf","evidence":"osv:CGA-gghx-m7px-wjmf","products":[{"name":{"value":"datahub-gms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.0.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gghx-m7px-wjmf","aliases":["CGA-gghx-m7px-wjmf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-r1"}]}],"package":{"name":"datahub-gms","purl":"pkg:apk/chainguard/datahub-gms?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gghx-m7px-wjmf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/datahub/datahub-gms/bin/war.war","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:36:08Z"}]}}],"modified":"2026-10-02T23:00:49.066806153Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25de85ee-cfcb-4581-9b00-bda7055025be","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gghx-m7px-wjmf","advisory_id":"25de85ee-cfcb-4581-9b00-bda7055025be","event_types":["advisory"],"published_at":"2026-10-25T23:08:08.32433+00:00","technologies":["core-osv","datahub-gms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T11:37:48+00:00","detail_url":"/events/71798"},"members":[{"id":71798,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gghx-m7px-wjmf","summary":"CGA-gghx-m7px-wjmf","evidence":"osv:CGA-gghx-m7px-wjmf","products":[{"name":{"value":"datahub-gms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.0.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gghx-m7px-wjmf","aliases":["CGA-gghx-m7px-wjmf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-r1"}]}],"package":{"name":"datahub-gms","purl":"pkg:apk/chainguard/datahub-gms?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gghx-m7px-wjmf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/datahub/datahub-gms/bin/war.war","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:36:08Z"}]}}],"modified":"2026-10-02T23:00:49.066806153Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25de85ee-cfcb-4581-9b00-bda7055025be","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gghx-m7px-wjmf","advisory_id":"25de85ee-cfcb-4581-9b00-bda7055025be","event_types":["advisory"],"published_at":"2026-10-25T23:08:08.32433+00:00","technologies":["core-osv","datahub-gms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T11:37:48+00:00","detail_url":"/events/71798"}]}},{"id":71385,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-fp33-vj89-9hwm","summary":"CGA-fp33-vj89-9hwm","evidence":"osv:CGA-fp33-vj89-9hwm","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fp33-vj89-9hwm","aliases":["CGA-fp33-vj89-9hwm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fp33-vj89-9hwm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:14Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fp33-vj89-9hwm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:14Z"}]}}],"modified":"2026-10-02T23:00:47.112497436Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1e7378b2-6ef1-43de-bdbd-523739ea246d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fp33-vj89-9hwm","advisory_id":"1e7378b2-6ef1-43de-bdbd-523739ea246d","event_types":["advisory"],"published_at":"2026-10-25T23:07:23.580641+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:11:41+00:00","detail_url":"/advisories/advisory%3A1e7378b2-6ef1-43de-bdbd-523739ea246d","group":{"id":"advisory:1e7378b2-6ef1-43de-bdbd-523739ea246d","revision":1,"primary_event_id":71776,"change":"published","superseded_by":[],"changed":{"id":71776,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-fp33-vj89-9hwm","summary":"CGA-fp33-vj89-9hwm","evidence":"osv:CGA-fp33-vj89-9hwm","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fp33-vj89-9hwm","aliases":["CGA-fp33-vj89-9hwm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fp33-vj89-9hwm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:14Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fp33-vj89-9hwm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:14Z"}]}}],"modified":"2026-10-02T23:00:47.112497436Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1e7378b2-6ef1-43de-bdbd-523739ea246d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fp33-vj89-9hwm","advisory_id":"1e7378b2-6ef1-43de-bdbd-523739ea246d","event_types":["advisory"],"published_at":"2026-10-25T23:07:23.580641+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:11:41+00:00","detail_url":"/events/71776"},"members":[{"id":71776,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-fp33-vj89-9hwm","summary":"CGA-fp33-vj89-9hwm","evidence":"osv:CGA-fp33-vj89-9hwm","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fp33-vj89-9hwm","aliases":["CGA-fp33-vj89-9hwm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fp33-vj89-9hwm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:14Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fp33-vj89-9hwm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/tools/upgrade-cli/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:13:14Z"}]}}],"modified":"2026-10-02T23:00:47.112497436Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1e7378b2-6ef1-43de-bdbd-523739ea246d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fp33-vj89-9hwm","advisory_id":"1e7378b2-6ef1-43de-bdbd-523739ea246d","event_types":["advisory"],"published_at":"2026-10-25T23:07:23.580641+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:11:41+00:00","detail_url":"/events/71776"}]}},{"id":71308,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-7f3m-2gqf-r47f","summary":"CGA-7f3m-2gqf-r47f","evidence":"osv:CGA-7f3m-2gqf-r47f","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7f3m-2gqf-r47f","aliases":["CGA-7f3m-2gqf-r47f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7f3m-2gqf-r47f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:09Z"}]}}],"modified":"2026-10-02T23:00:39.548063549Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:919e879c-6f64-485f-a82d-476d1dc803e5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7f3m-2gqf-r47f","advisory_id":"919e879c-6f64-485f-a82d-476d1dc803e5","event_types":["advisory"],"published_at":"2026-10-25T23:02:08.952555+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:16+00:00","detail_url":"/advisories/advisory%3A919e879c-6f64-485f-a82d-476d1dc803e5","group":{"id":"advisory:919e879c-6f64-485f-a82d-476d1dc803e5","revision":1,"primary_event_id":71697,"change":"published","superseded_by":[],"changed":{"id":71697,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-7f3m-2gqf-r47f","summary":"CGA-7f3m-2gqf-r47f","evidence":"osv:CGA-7f3m-2gqf-r47f","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7f3m-2gqf-r47f","aliases":["CGA-7f3m-2gqf-r47f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7f3m-2gqf-r47f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:09Z"}]}}],"modified":"2026-10-02T23:00:39.548063549Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:919e879c-6f64-485f-a82d-476d1dc803e5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7f3m-2gqf-r47f","advisory_id":"919e879c-6f64-485f-a82d-476d1dc803e5","event_types":["advisory"],"published_at":"2026-10-25T23:02:08.952555+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:16+00:00","detail_url":"/events/71697"},"members":[{"id":71697,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-7f3m-2gqf-r47f","summary":"CGA-7f3m-2gqf-r47f","evidence":"osv:CGA-7f3m-2gqf-r47f","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7f3m-2gqf-r47f","aliases":["CGA-7f3m-2gqf-r47f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7f3m-2gqf-r47f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:09Z"}]}}],"modified":"2026-10-02T23:00:39.548063549Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:919e879c-6f64-485f-a82d-476d1dc803e5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7f3m-2gqf-r47f","advisory_id":"919e879c-6f64-485f-a82d-476d1dc803e5","event_types":["advisory"],"published_at":"2026-10-25T23:02:08.952555+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:16+00:00","detail_url":"/events/71697"}]}},{"id":71282,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-67m4-9x7m-8hg4","summary":"CGA-67m4-9x7m-8hg4","evidence":"osv:CGA-67m4-9x7m-8hg4","products":[{"name":{"value":"opensearch-2-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-67m4-9x7m-8hg4","aliases":["CGA-67m4-9x7m-8hg4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-ml-commons","purl":"pkg:apk/chainguard/opensearch-2-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67m4-9x7m-8hg4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:08Z"}]}}],"modified":"2026-10-02T23:00:36.491017006Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f672437-9c5c-435a-be52-13c508193e2e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67m4-9x7m-8hg4","advisory_id":"6f672437-9c5c-435a-be52-13c508193e2e","event_types":["advisory"],"published_at":"2026-10-25T23:00:35.040248+00:00","technologies":["core-osv","opensearch-2-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:34:19+00:00","detail_url":"/advisories/advisory%3A6f672437-9c5c-435a-be52-13c508193e2e","group":{"id":"advisory:6f672437-9c5c-435a-be52-13c508193e2e","revision":1,"primary_event_id":71668,"change":"published","superseded_by":[],"changed":{"id":71668,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-67m4-9x7m-8hg4","summary":"CGA-67m4-9x7m-8hg4","evidence":"osv:CGA-67m4-9x7m-8hg4","products":[{"name":{"value":"opensearch-2-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-67m4-9x7m-8hg4","aliases":["CGA-67m4-9x7m-8hg4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-ml-commons","purl":"pkg:apk/chainguard/opensearch-2-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67m4-9x7m-8hg4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:08Z"}]}}],"modified":"2026-10-02T23:00:36.491017006Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f672437-9c5c-435a-be52-13c508193e2e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67m4-9x7m-8hg4","advisory_id":"6f672437-9c5c-435a-be52-13c508193e2e","event_types":["advisory"],"published_at":"2026-10-25T23:00:35.040248+00:00","technologies":["core-osv","opensearch-2-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:34:19+00:00","detail_url":"/events/71668"},"members":[{"id":71668,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-67m4-9x7m-8hg4","summary":"CGA-67m4-9x7m-8hg4","evidence":"osv:CGA-67m4-9x7m-8hg4","products":[{"name":{"value":"opensearch-2-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-67m4-9x7m-8hg4","aliases":["CGA-67m4-9x7m-8hg4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-ml-commons","purl":"pkg:apk/chainguard/opensearch-2-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67m4-9x7m-8hg4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:08Z"}]}}],"modified":"2026-10-02T23:00:36.491017006Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f672437-9c5c-435a-be52-13c508193e2e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67m4-9x7m-8hg4","advisory_id":"6f672437-9c5c-435a-be52-13c508193e2e","event_types":["advisory"],"published_at":"2026-10-25T23:00:35.040248+00:00","technologies":["core-osv","opensearch-2-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:34:19+00:00","detail_url":"/events/71668"}]}},{"id":71276,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-5q5v-2xxc-5c7f","summary":"CGA-5q5v-2xxc-5c7f","evidence":"osv:CGA-5q5v-2xxc-5c7f","products":[{"name":{"value":"opensearch-2-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5q5v-2xxc-5c7f","aliases":["CGA-5q5v-2xxc-5c7f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-sql","purl":"pkg:apk/chainguard/opensearch-2-sql?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5q5v-2xxc-5c7f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:22:08Z"}]}}],"modified":"2026-10-02T23:00:35.840415749Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2a9942bb-292b-47fc-bc64-8809b8dbef33","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5q5v-2xxc-5c7f","advisory_id":"2a9942bb-292b-47fc-bc64-8809b8dbef33","event_types":["advisory"],"published_at":"2026-10-25T23:00:26.31646+00:00","technologies":["core-osv","opensearch-2-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:46:16+00:00","detail_url":"/advisories/advisory%3A2a9942bb-292b-47fc-bc64-8809b8dbef33","group":{"id":"advisory:2a9942bb-292b-47fc-bc64-8809b8dbef33","revision":1,"primary_event_id":71662,"change":"published","superseded_by":[],"changed":{"id":71662,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-5q5v-2xxc-5c7f","summary":"CGA-5q5v-2xxc-5c7f","evidence":"osv:CGA-5q5v-2xxc-5c7f","products":[{"name":{"value":"opensearch-2-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5q5v-2xxc-5c7f","aliases":["CGA-5q5v-2xxc-5c7f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-sql","purl":"pkg:apk/chainguard/opensearch-2-sql?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5q5v-2xxc-5c7f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:22:08Z"}]}}],"modified":"2026-10-02T23:00:35.840415749Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2a9942bb-292b-47fc-bc64-8809b8dbef33","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5q5v-2xxc-5c7f","advisory_id":"2a9942bb-292b-47fc-bc64-8809b8dbef33","event_types":["advisory"],"published_at":"2026-10-25T23:00:26.31646+00:00","technologies":["core-osv","opensearch-2-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:46:16+00:00","detail_url":"/events/71662"},"members":[{"id":71662,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-5q5v-2xxc-5c7f","summary":"CGA-5q5v-2xxc-5c7f","evidence":"osv:CGA-5q5v-2xxc-5c7f","products":[{"name":{"value":"opensearch-2-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5q5v-2xxc-5c7f","aliases":["CGA-5q5v-2xxc-5c7f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r16"}]}],"package":{"name":"opensearch-2-sql","purl":"pkg:apk/chainguard/opensearch-2-sql?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5q5v-2xxc-5c7f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:22:08Z"}]}}],"modified":"2026-10-02T23:00:35.840415749Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2a9942bb-292b-47fc-bc64-8809b8dbef33","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5q5v-2xxc-5c7f","advisory_id":"2a9942bb-292b-47fc-bc64-8809b8dbef33","event_types":["advisory"],"published_at":"2026-10-25T23:00:26.31646+00:00","technologies":["core-osv","opensearch-2-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:46:16+00:00","detail_url":"/events/71662"}]}},{"id":71251,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-48qc-5ph2-mh4x","summary":"CGA-48qc-5ph2-mh4x","evidence":"osv:CGA-48qc-5ph2-mh4x","products":[{"name":{"value":"logstash-fips-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-48qc-5ph2-mh4x","aliases":["CGA-48qc-5ph2-mh4x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-fips-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-48qc-5ph2-mh4x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:41:42Z"}]}}],"modified":"2026-10-02T23:00:33.682636475Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:024b1934-26c0-43bd-a307-37e310a7a050","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-48qc-5ph2-mh4x","advisory_id":"024b1934-26c0-43bd-a307-37e310a7a050","event_types":["advisory"],"published_at":"2026-10-25T22:58:57.936765+00:00","technologies":["core-osv","logstash-fips-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:24:50+00:00","detail_url":"/advisories/advisory%3A024b1934-26c0-43bd-a307-37e310a7a050","group":{"id":"advisory:024b1934-26c0-43bd-a307-37e310a7a050","revision":1,"primary_event_id":71636,"change":"published","superseded_by":[],"changed":{"id":71636,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-48qc-5ph2-mh4x","summary":"CGA-48qc-5ph2-mh4x","evidence":"osv:CGA-48qc-5ph2-mh4x","products":[{"name":{"value":"logstash-fips-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-48qc-5ph2-mh4x","aliases":["CGA-48qc-5ph2-mh4x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-fips-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-48qc-5ph2-mh4x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:41:42Z"}]}}],"modified":"2026-10-02T23:00:33.682636475Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:024b1934-26c0-43bd-a307-37e310a7a050","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-48qc-5ph2-mh4x","advisory_id":"024b1934-26c0-43bd-a307-37e310a7a050","event_types":["advisory"],"published_at":"2026-10-25T22:58:57.936765+00:00","technologies":["core-osv","logstash-fips-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:24:50+00:00","detail_url":"/events/71636"},"members":[{"id":71636,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-48qc-5ph2-mh4x","summary":"CGA-48qc-5ph2-mh4x","evidence":"osv:CGA-48qc-5ph2-mh4x","products":[{"name":{"value":"logstash-fips-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-48qc-5ph2-mh4x","aliases":["CGA-48qc-5ph2-mh4x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-fips-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-48qc-5ph2-mh4x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:41:42Z"}]}}],"modified":"2026-10-02T23:00:33.682636475Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:024b1934-26c0-43bd-a307-37e310a7a050","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-48qc-5ph2-mh4x","advisory_id":"024b1934-26c0-43bd-a307-37e310a7a050","event_types":["advisory"],"published_at":"2026-10-25T22:58:57.936765+00:00","technologies":["core-osv","logstash-fips-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:24:50+00:00","detail_url":"/events/71636"}]}}],"next_after":72053,"next_before":71251}