{"schema_version":"2","view":"grouped","data":[{"id":72933,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8p3j-455x-qxmj","summary":"CGA-8p3j-455x-qxmj","evidence":"osv:CGA-8p3j-455x-qxmj","products":[{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8p3j-455x-qxmj","aliases":["CGA-8p3j-455x-qxmj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8p3j-455x-qxmj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:34Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/wolfi/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8p3j-455x-qxmj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:34Z"}]}}],"modified":"2026-10-03T10:32:36.768776715Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7cae0c1e-77bf-4ac6-bd88-dad8f7536013","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8p3j-455x-qxmj","advisory_id":"7cae0c1e-77bf-4ac6-bd88-dad8f7536013","event_types":["advisory"],"published_at":"2026-10-26T01:40:19.726221+00:00","technologies":["core-osv","opensearch-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:05:46+00:00","detail_url":"/advisories/advisory%3A7cae0c1e-77bf-4ac6-bd88-dad8f7536013","group":{"id":"advisory:7cae0c1e-77bf-4ac6-bd88-dad8f7536013","revision":1,"primary_event_id":73983,"change":"published","superseded_by":[],"changed":{"id":73983,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8p3j-455x-qxmj","summary":"CGA-8p3j-455x-qxmj","evidence":"osv:CGA-8p3j-455x-qxmj","products":[{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8p3j-455x-qxmj","aliases":["CGA-8p3j-455x-qxmj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8p3j-455x-qxmj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:34Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/wolfi/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8p3j-455x-qxmj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:34Z"}]}}],"modified":"2026-10-03T10:32:36.768776715Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7cae0c1e-77bf-4ac6-bd88-dad8f7536013","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8p3j-455x-qxmj","advisory_id":"7cae0c1e-77bf-4ac6-bd88-dad8f7536013","event_types":["advisory"],"published_at":"2026-10-26T01:40:19.726221+00:00","technologies":["core-osv","opensearch-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:05:46+00:00","detail_url":"/events/73983"},"members":[{"id":73983,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8p3j-455x-qxmj","summary":"CGA-8p3j-455x-qxmj","evidence":"osv:CGA-8p3j-455x-qxmj","products":[{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8p3j-455x-qxmj","aliases":["CGA-8p3j-455x-qxmj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8p3j-455x-qxmj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:34Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/wolfi/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8p3j-455x-qxmj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:34Z"}]}}],"modified":"2026-10-03T10:32:36.768776715Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7cae0c1e-77bf-4ac6-bd88-dad8f7536013","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8p3j-455x-qxmj","advisory_id":"7cae0c1e-77bf-4ac6-bd88-dad8f7536013","event_types":["advisory"],"published_at":"2026-10-26T01:40:19.726221+00:00","technologies":["core-osv","opensearch-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:05:46+00:00","detail_url":"/events/73983"}]}},{"id":72930,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-cmvm-mh8r-4cjf","summary":"CGA-cmvm-mh8r-4cjf","evidence":"osv:CGA-cmvm-mh8r-4cjf","products":[{"name":{"value":"drain-cleaner","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.6.1-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cmvm-mh8r-4cjf","aliases":["CGA-cmvm-mh8r-4cjf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-r7"}]}],"package":{"name":"drain-cleaner","purl":"pkg:apk/chainguard/drain-cleaner?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cmvm-mh8r-4cjf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/strimzi/lib/main/com.fasterxml.jackson.core.jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:27:44Z"}]}}],"modified":"2026-10-03T10:32:38.973834855Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8411f304-b413-495d-81b9-50fe13ec7c24","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cmvm-mh8r-4cjf","advisory_id":"8411f304-b413-495d-81b9-50fe13ec7c24","event_types":["advisory"],"published_at":"2026-10-26T01:39:19.006871+00:00","technologies":["core-osv","drain-cleaner"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:17:34+00:00","detail_url":"/advisories/advisory%3A8411f304-b413-495d-81b9-50fe13ec7c24","group":{"id":"advisory:8411f304-b413-495d-81b9-50fe13ec7c24","revision":1,"primary_event_id":73973,"change":"published","superseded_by":[],"changed":{"id":73973,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-cmvm-mh8r-4cjf","summary":"CGA-cmvm-mh8r-4cjf","evidence":"osv:CGA-cmvm-mh8r-4cjf","products":[{"name":{"value":"drain-cleaner","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.6.1-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cmvm-mh8r-4cjf","aliases":["CGA-cmvm-mh8r-4cjf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-r7"}]}],"package":{"name":"drain-cleaner","purl":"pkg:apk/chainguard/drain-cleaner?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cmvm-mh8r-4cjf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/strimzi/lib/main/com.fasterxml.jackson.core.jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:27:44Z"}]}}],"modified":"2026-10-03T10:32:38.973834855Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8411f304-b413-495d-81b9-50fe13ec7c24","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cmvm-mh8r-4cjf","advisory_id":"8411f304-b413-495d-81b9-50fe13ec7c24","event_types":["advisory"],"published_at":"2026-10-26T01:39:19.006871+00:00","technologies":["core-osv","drain-cleaner"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:17:34+00:00","detail_url":"/events/73973"},"members":[{"id":73973,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-cmvm-mh8r-4cjf","summary":"CGA-cmvm-mh8r-4cjf","evidence":"osv:CGA-cmvm-mh8r-4cjf","products":[{"name":{"value":"drain-cleaner","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.6.1-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cmvm-mh8r-4cjf","aliases":["CGA-cmvm-mh8r-4cjf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-r7"}]}],"package":{"name":"drain-cleaner","purl":"pkg:apk/chainguard/drain-cleaner?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cmvm-mh8r-4cjf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/strimzi/lib/main/com.fasterxml.jackson.core.jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:27:44Z"}]}}],"modified":"2026-10-03T10:32:38.973834855Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8411f304-b413-495d-81b9-50fe13ec7c24","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cmvm-mh8r-4cjf","advisory_id":"8411f304-b413-495d-81b9-50fe13ec7c24","event_types":["advisory"],"published_at":"2026-10-26T01:39:19.006871+00:00","technologies":["core-osv","drain-cleaner"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:17:34+00:00","detail_url":"/events/73973"}]}},{"id":72924,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-f49h-hx3j-594m","summary":"CGA-f49h-hx3j-594m","evidence":"osv:CGA-f49h-hx3j-594m","products":[{"name":{"value":"eco-java-gradle-6.2.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f49h-hx3j-594m","aliases":["CGA-f49h-hx3j-594m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-6.2.2","purl":"pkg:apk/chainguard/eco-java-gradle-6.2.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f49h-hx3j-594m.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.9.10","component_type":"java-archive","component_version":"2.9.10","component_location":"/usr/lib/gradle/6.2.2/lib/plugins/jackson-core-2.9.10.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T01:55:49Z"}]}}],"modified":"2026-10-03T10:32:39.763451699Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b87a79ae-4501-41bc-80ce-874058ecebcc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f49h-hx3j-594m","advisory_id":"b87a79ae-4501-41bc-80ce-874058ecebcc","event_types":["advisory"],"published_at":"2026-10-26T01:38:08.549347+00:00","technologies":["core-osv","eco-java-gradle-6-2-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:09:22+00:00","detail_url":"/advisories/advisory%3Ab87a79ae-4501-41bc-80ce-874058ecebcc","group":{"id":"advisory:b87a79ae-4501-41bc-80ce-874058ecebcc","revision":1,"primary_event_id":73960,"change":"published","superseded_by":[],"changed":{"id":73960,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-f49h-hx3j-594m","summary":"CGA-f49h-hx3j-594m","evidence":"osv:CGA-f49h-hx3j-594m","products":[{"name":{"value":"eco-java-gradle-6.2.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f49h-hx3j-594m","aliases":["CGA-f49h-hx3j-594m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-6.2.2","purl":"pkg:apk/chainguard/eco-java-gradle-6.2.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f49h-hx3j-594m.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.9.10","component_type":"java-archive","component_version":"2.9.10","component_location":"/usr/lib/gradle/6.2.2/lib/plugins/jackson-core-2.9.10.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T01:55:49Z"}]}}],"modified":"2026-10-03T10:32:39.763451699Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b87a79ae-4501-41bc-80ce-874058ecebcc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f49h-hx3j-594m","advisory_id":"b87a79ae-4501-41bc-80ce-874058ecebcc","event_types":["advisory"],"published_at":"2026-10-26T01:38:08.549347+00:00","technologies":["core-osv","eco-java-gradle-6-2-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:09:22+00:00","detail_url":"/events/73960"},"members":[{"id":73960,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-f49h-hx3j-594m","summary":"CGA-f49h-hx3j-594m","evidence":"osv:CGA-f49h-hx3j-594m","products":[{"name":{"value":"eco-java-gradle-6.2.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f49h-hx3j-594m","aliases":["CGA-f49h-hx3j-594m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-6.2.2","purl":"pkg:apk/chainguard/eco-java-gradle-6.2.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f49h-hx3j-594m.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.9.10","component_type":"java-archive","component_version":"2.9.10","component_location":"/usr/lib/gradle/6.2.2/lib/plugins/jackson-core-2.9.10.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T01:55:49Z"}]}}],"modified":"2026-10-03T10:32:39.763451699Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b87a79ae-4501-41bc-80ce-874058ecebcc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f49h-hx3j-594m","advisory_id":"b87a79ae-4501-41bc-80ce-874058ecebcc","event_types":["advisory"],"published_at":"2026-10-26T01:38:08.549347+00:00","technologies":["core-osv","eco-java-gradle-6-2-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:09:22+00:00","detail_url":"/events/73960"}]}},{"id":72916,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c25j-m8rp-86m2","summary":"CGA-c25j-m8rp-86m2","evidence":"osv:CGA-c25j-m8rp-86m2","products":[{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c25j-m8rp-86m2","aliases":["CGA-c25j-m8rp-86m2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/chainguard/opensearch-3-repository-azure?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c25j-m8rp-86m2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:04:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/wolfi/opensearch-3-repository-azure?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c25j-m8rp-86m2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:04:08Z"}]}}],"modified":"2026-10-03T10:32:38.406051020Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:953959bb-0112-4dd0-b105-99eb0f8bad65","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c25j-m8rp-86m2","advisory_id":"953959bb-0112-4dd0-b105-99eb0f8bad65","event_types":["advisory"],"published_at":"2026-10-26T01:36:05.04864+00:00","technologies":["core-osv","opensearch-3-repository-azure"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:03:25+00:00","detail_url":"/advisories/advisory%3A953959bb-0112-4dd0-b105-99eb0f8bad65","group":{"id":"advisory:953959bb-0112-4dd0-b105-99eb0f8bad65","revision":1,"primary_event_id":73936,"change":"published","superseded_by":[],"changed":{"id":73936,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c25j-m8rp-86m2","summary":"CGA-c25j-m8rp-86m2","evidence":"osv:CGA-c25j-m8rp-86m2","products":[{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c25j-m8rp-86m2","aliases":["CGA-c25j-m8rp-86m2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/chainguard/opensearch-3-repository-azure?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c25j-m8rp-86m2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:04:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/wolfi/opensearch-3-repository-azure?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c25j-m8rp-86m2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:04:08Z"}]}}],"modified":"2026-10-03T10:32:38.406051020Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:953959bb-0112-4dd0-b105-99eb0f8bad65","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c25j-m8rp-86m2","advisory_id":"953959bb-0112-4dd0-b105-99eb0f8bad65","event_types":["advisory"],"published_at":"2026-10-26T01:36:05.04864+00:00","technologies":["core-osv","opensearch-3-repository-azure"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:03:25+00:00","detail_url":"/events/73936"},"members":[{"id":73936,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c25j-m8rp-86m2","summary":"CGA-c25j-m8rp-86m2","evidence":"osv:CGA-c25j-m8rp-86m2","products":[{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c25j-m8rp-86m2","aliases":["CGA-c25j-m8rp-86m2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/chainguard/opensearch-3-repository-azure?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c25j-m8rp-86m2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:04:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/wolfi/opensearch-3-repository-azure?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c25j-m8rp-86m2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:04:08Z"}]}}],"modified":"2026-10-03T10:32:38.406051020Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:953959bb-0112-4dd0-b105-99eb0f8bad65","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c25j-m8rp-86m2","advisory_id":"953959bb-0112-4dd0-b105-99eb0f8bad65","event_types":["advisory"],"published_at":"2026-10-26T01:36:05.04864+00:00","technologies":["core-osv","opensearch-3-repository-azure"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:03:25+00:00","detail_url":"/events/73936"}]}},{"id":72915,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c2cx-3f7m-4h39","summary":"CGA-c2cx-3f7m-4h39","evidence":"osv:CGA-c2cx-3f7m-4h39","products":[{"name":{"value":"elasticsearch-8.19-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c2cx-3f7m-4h39","aliases":["CGA-c2cx-3f7m-4h39"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-8.19-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-8.19-iamguarded-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2cx-3f7m-4h39.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/opt/iamguarded/elasticsearch/modules/legacy-geo/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:48:04Z"}]}}],"modified":"2026-10-03T10:32:38.389895916Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42e3bee7-188f-4dd4-a962-94ded45c8886","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2cx-3f7m-4h39","advisory_id":"42e3bee7-188f-4dd4-a962-94ded45c8886","event_types":["advisory"],"published_at":"2026-10-26T01:35:47.25466+00:00","technologies":["core-osv","elasticsearch-8-19-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:52:57+00:00","detail_url":"/advisories/advisory%3A42e3bee7-188f-4dd4-a962-94ded45c8886","group":{"id":"advisory:42e3bee7-188f-4dd4-a962-94ded45c8886","revision":1,"primary_event_id":73934,"change":"published","superseded_by":[],"changed":{"id":73934,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c2cx-3f7m-4h39","summary":"CGA-c2cx-3f7m-4h39","evidence":"osv:CGA-c2cx-3f7m-4h39","products":[{"name":{"value":"elasticsearch-8.19-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c2cx-3f7m-4h39","aliases":["CGA-c2cx-3f7m-4h39"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-8.19-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-8.19-iamguarded-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2cx-3f7m-4h39.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/opt/iamguarded/elasticsearch/modules/legacy-geo/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:48:04Z"}]}}],"modified":"2026-10-03T10:32:38.389895916Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42e3bee7-188f-4dd4-a962-94ded45c8886","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2cx-3f7m-4h39","advisory_id":"42e3bee7-188f-4dd4-a962-94ded45c8886","event_types":["advisory"],"published_at":"2026-10-26T01:35:47.25466+00:00","technologies":["core-osv","elasticsearch-8-19-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:52:57+00:00","detail_url":"/events/73934"},"members":[{"id":73934,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c2cx-3f7m-4h39","summary":"CGA-c2cx-3f7m-4h39","evidence":"osv:CGA-c2cx-3f7m-4h39","products":[{"name":{"value":"elasticsearch-8.19-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c2cx-3f7m-4h39","aliases":["CGA-c2cx-3f7m-4h39"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-8.19-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-8.19-iamguarded-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2cx-3f7m-4h39.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/opt/iamguarded/elasticsearch/modules/legacy-geo/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:48:04Z"}]}}],"modified":"2026-10-03T10:32:38.389895916Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42e3bee7-188f-4dd4-a962-94ded45c8886","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2cx-3f7m-4h39","advisory_id":"42e3bee7-188f-4dd4-a962-94ded45c8886","event_types":["advisory"],"published_at":"2026-10-26T01:35:47.25466+00:00","technologies":["core-osv","elasticsearch-8-19-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:52:57+00:00","detail_url":"/events/73934"}]}},{"id":72914,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c58w-mp7c-v3m6","summary":"CGA-c58w-mp7c-v3m6","evidence":"osv:CGA-c58w-mp7c-v3m6","products":[{"name":{"value":"hadoop-fips-3.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.0-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c58w-mp7c-v3m6","aliases":["CGA-c58w-mp7c-v3m6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-r18"}]}],"package":{"name":"hadoop-fips-3.5","purl":"pkg:apk/chainguard/hadoop-fips-3.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c58w-mp7c-v3m6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/m2/repository/org/apache/hadoop/hadoop-client-runtime/3.5.0/hadoop-client-runtime-3.5.0.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T22:05:16Z"}]}}],"modified":"2026-10-03T10:32:38.357638829Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:582c47c8-0fa5-4409-b945-99bc1031ce17","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c58w-mp7c-v3m6","advisory_id":"582c47c8-0fa5-4409-b945-99bc1031ce17","event_types":["advisory"],"published_at":"2026-10-26T01:35:15.440858+00:00","technologies":["core-osv","hadoop-fips-3-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:09:42+00:00","detail_url":"/advisories/advisory%3A582c47c8-0fa5-4409-b945-99bc1031ce17","group":{"id":"advisory:582c47c8-0fa5-4409-b945-99bc1031ce17","revision":1,"primary_event_id":73930,"change":"published","superseded_by":[],"changed":{"id":73930,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c58w-mp7c-v3m6","summary":"CGA-c58w-mp7c-v3m6","evidence":"osv:CGA-c58w-mp7c-v3m6","products":[{"name":{"value":"hadoop-fips-3.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.0-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c58w-mp7c-v3m6","aliases":["CGA-c58w-mp7c-v3m6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-r18"}]}],"package":{"name":"hadoop-fips-3.5","purl":"pkg:apk/chainguard/hadoop-fips-3.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c58w-mp7c-v3m6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/m2/repository/org/apache/hadoop/hadoop-client-runtime/3.5.0/hadoop-client-runtime-3.5.0.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T22:05:16Z"}]}}],"modified":"2026-10-03T10:32:38.357638829Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:582c47c8-0fa5-4409-b945-99bc1031ce17","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c58w-mp7c-v3m6","advisory_id":"582c47c8-0fa5-4409-b945-99bc1031ce17","event_types":["advisory"],"published_at":"2026-10-26T01:35:15.440858+00:00","technologies":["core-osv","hadoop-fips-3-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:09:42+00:00","detail_url":"/events/73930"},"members":[{"id":73930,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c58w-mp7c-v3m6","summary":"CGA-c58w-mp7c-v3m6","evidence":"osv:CGA-c58w-mp7c-v3m6","products":[{"name":{"value":"hadoop-fips-3.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.0-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c58w-mp7c-v3m6","aliases":["CGA-c58w-mp7c-v3m6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-r18"}]}],"package":{"name":"hadoop-fips-3.5","purl":"pkg:apk/chainguard/hadoop-fips-3.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c58w-mp7c-v3m6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/m2/repository/org/apache/hadoop/hadoop-client-runtime/3.5.0/hadoop-client-runtime-3.5.0.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T22:05:16Z"}]}}],"modified":"2026-10-03T10:32:38.357638829Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:582c47c8-0fa5-4409-b945-99bc1031ce17","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c58w-mp7c-v3m6","advisory_id":"582c47c8-0fa5-4409-b945-99bc1031ce17","event_types":["advisory"],"published_at":"2026-10-26T01:35:15.440858+00:00","technologies":["core-osv","hadoop-fips-3-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:09:42+00:00","detail_url":"/events/73930"}]}},{"id":72913,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-7vh3-frhg-qvjr","summary":"CGA-7vh3-frhg-qvjr","evidence":"osv:CGA-7vh3-frhg-qvjr","products":[{"name":{"value":"opensearch-fips-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7vh3-frhg-qvjr","aliases":["CGA-7vh3-frhg-qvjr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-observability","purl":"pkg:apk/chainguard/opensearch-fips-3-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7vh3-frhg-qvjr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:46:12Z"}]}}],"modified":"2026-10-03T10:32:35.817017496Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d7452e7a-cee3-455a-b1e2-36f495a9887f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7vh3-frhg-qvjr","advisory_id":"d7452e7a-cee3-455a-b1e2-36f495a9887f","event_types":["advisory"],"published_at":"2026-10-26T01:35:06.637682+00:00","technologies":["core-osv","opensearch-fips-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:17:06+00:00","detail_url":"/advisories/advisory%3Ad7452e7a-cee3-455a-b1e2-36f495a9887f","group":{"id":"advisory:d7452e7a-cee3-455a-b1e2-36f495a9887f","revision":1,"primary_event_id":73929,"change":"published","superseded_by":[],"changed":{"id":73929,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-7vh3-frhg-qvjr","summary":"CGA-7vh3-frhg-qvjr","evidence":"osv:CGA-7vh3-frhg-qvjr","products":[{"name":{"value":"opensearch-fips-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7vh3-frhg-qvjr","aliases":["CGA-7vh3-frhg-qvjr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-observability","purl":"pkg:apk/chainguard/opensearch-fips-3-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7vh3-frhg-qvjr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:46:12Z"}]}}],"modified":"2026-10-03T10:32:35.817017496Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d7452e7a-cee3-455a-b1e2-36f495a9887f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7vh3-frhg-qvjr","advisory_id":"d7452e7a-cee3-455a-b1e2-36f495a9887f","event_types":["advisory"],"published_at":"2026-10-26T01:35:06.637682+00:00","technologies":["core-osv","opensearch-fips-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:17:06+00:00","detail_url":"/events/73929"},"members":[{"id":73929,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-7vh3-frhg-qvjr","summary":"CGA-7vh3-frhg-qvjr","evidence":"osv:CGA-7vh3-frhg-qvjr","products":[{"name":{"value":"opensearch-fips-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7vh3-frhg-qvjr","aliases":["CGA-7vh3-frhg-qvjr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-observability","purl":"pkg:apk/chainguard/opensearch-fips-3-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7vh3-frhg-qvjr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:46:12Z"}]}}],"modified":"2026-10-03T10:32:35.817017496Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d7452e7a-cee3-455a-b1e2-36f495a9887f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7vh3-frhg-qvjr","advisory_id":"d7452e7a-cee3-455a-b1e2-36f495a9887f","event_types":["advisory"],"published_at":"2026-10-26T01:35:06.637682+00:00","technologies":["core-osv","opensearch-fips-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:17:06+00:00","detail_url":"/events/73929"}]}},{"id":72912,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c2mr-9r2g-5wp9","summary":"CGA-c2mr-9r2g-5wp9","evidence":"osv:CGA-c2mr-9r2g-5wp9","products":[{"name":{"value":"jenkins-plugin-manager","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.15.0-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"jenkins-plugin-manager","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.15.0-r7","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c2mr-9r2g-5wp9","aliases":["CGA-c2mr-9r2g-5wp9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r7"}]}],"package":{"name":"jenkins-plugin-manager","purl":"pkg:apk/chainguard/jenkins-plugin-manager?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2mr-9r2g-5wp9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/jenkins-plugin-manager/jenkins-plugin-manager.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T23:18:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r7"}]}],"package":{"name":"jenkins-plugin-manager","purl":"pkg:apk/wolfi/jenkins-plugin-manager?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2mr-9r2g-5wp9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/jenkins-plugin-manager/jenkins-plugin-manager.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T23:18:06Z"}]}}],"modified":"2026-10-03T10:32:38.383664461Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3c4db241-b6ba-421e-9e9a-b580d3cb3cd6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2mr-9r2g-5wp9","advisory_id":"3c4db241-b6ba-421e-9e9a-b580d3cb3cd6","event_types":["advisory"],"published_at":"2026-10-26T01:34:48.657262+00:00","technologies":["core-osv","jenkins-plugin-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:47+00:00","detail_url":"/advisories/advisory%3A3c4db241-b6ba-421e-9e9a-b580d3cb3cd6","group":{"id":"advisory:3c4db241-b6ba-421e-9e9a-b580d3cb3cd6","revision":1,"primary_event_id":73927,"change":"published","superseded_by":[],"changed":{"id":73927,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c2mr-9r2g-5wp9","summary":"CGA-c2mr-9r2g-5wp9","evidence":"osv:CGA-c2mr-9r2g-5wp9","products":[{"name":{"value":"jenkins-plugin-manager","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.15.0-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"jenkins-plugin-manager","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.15.0-r7","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c2mr-9r2g-5wp9","aliases":["CGA-c2mr-9r2g-5wp9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r7"}]}],"package":{"name":"jenkins-plugin-manager","purl":"pkg:apk/chainguard/jenkins-plugin-manager?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2mr-9r2g-5wp9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/jenkins-plugin-manager/jenkins-plugin-manager.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T23:18:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r7"}]}],"package":{"name":"jenkins-plugin-manager","purl":"pkg:apk/wolfi/jenkins-plugin-manager?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2mr-9r2g-5wp9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/jenkins-plugin-manager/jenkins-plugin-manager.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T23:18:06Z"}]}}],"modified":"2026-10-03T10:32:38.383664461Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3c4db241-b6ba-421e-9e9a-b580d3cb3cd6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2mr-9r2g-5wp9","advisory_id":"3c4db241-b6ba-421e-9e9a-b580d3cb3cd6","event_types":["advisory"],"published_at":"2026-10-26T01:34:48.657262+00:00","technologies":["core-osv","jenkins-plugin-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:47+00:00","detail_url":"/events/73927"},"members":[{"id":73927,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-c2mr-9r2g-5wp9","summary":"CGA-c2mr-9r2g-5wp9","evidence":"osv:CGA-c2mr-9r2g-5wp9","products":[{"name":{"value":"jenkins-plugin-manager","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.15.0-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"jenkins-plugin-manager","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.15.0-r7","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-c2mr-9r2g-5wp9","aliases":["CGA-c2mr-9r2g-5wp9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r7"}]}],"package":{"name":"jenkins-plugin-manager","purl":"pkg:apk/chainguard/jenkins-plugin-manager?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2mr-9r2g-5wp9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/jenkins-plugin-manager/jenkins-plugin-manager.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T23:18:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r7"}]}],"package":{"name":"jenkins-plugin-manager","purl":"pkg:apk/wolfi/jenkins-plugin-manager?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2mr-9r2g-5wp9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/jenkins-plugin-manager/jenkins-plugin-manager.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T23:18:06Z"}]}}],"modified":"2026-10-03T10:32:38.383664461Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3c4db241-b6ba-421e-9e9a-b580d3cb3cd6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2mr-9r2g-5wp9","advisory_id":"3c4db241-b6ba-421e-9e9a-b580d3cb3cd6","event_types":["advisory"],"published_at":"2026-10-26T01:34:48.657262+00:00","technologies":["core-osv","jenkins-plugin-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:47+00:00","detail_url":"/events/73927"}]}},{"id":72895,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-cmrw-7929-7rgj","summary":"CGA-cmrw-7929-7rgj","evidence":"osv:CGA-cmrw-7929-7rgj","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cmrw-7929-7rgj","aliases":["CGA-cmrw-7929-7rgj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cmrw-7929-7rgj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:42Z"}]}}],"modified":"2026-10-03T10:32:39.002991634Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:555978ea-feca-4526-a74b-a90c50f742b8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cmrw-7929-7rgj","advisory_id":"555978ea-feca-4526-a74b-a90c50f742b8","event_types":["advisory"],"published_at":"2026-10-26T01:31:25.836761+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T16:40:56+00:00","detail_url":"/advisories/advisory%3A555978ea-feca-4526-a74b-a90c50f742b8","group":{"id":"advisory:555978ea-feca-4526-a74b-a90c50f742b8","revision":1,"primary_event_id":73885,"change":"published","superseded_by":[],"changed":{"id":73885,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-cmrw-7929-7rgj","summary":"CGA-cmrw-7929-7rgj","evidence":"osv:CGA-cmrw-7929-7rgj","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cmrw-7929-7rgj","aliases":["CGA-cmrw-7929-7rgj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cmrw-7929-7rgj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:42Z"}]}}],"modified":"2026-10-03T10:32:39.002991634Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:555978ea-feca-4526-a74b-a90c50f742b8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cmrw-7929-7rgj","advisory_id":"555978ea-feca-4526-a74b-a90c50f742b8","event_types":["advisory"],"published_at":"2026-10-26T01:31:25.836761+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T16:40:56+00:00","detail_url":"/events/73885"},"members":[{"id":73885,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-cmrw-7929-7rgj","summary":"CGA-cmrw-7929-7rgj","evidence":"osv:CGA-cmrw-7929-7rgj","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cmrw-7929-7rgj","aliases":["CGA-cmrw-7929-7rgj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cmrw-7929-7rgj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:42Z"}]}}],"modified":"2026-10-03T10:32:39.002991634Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:555978ea-feca-4526-a74b-a90c50f742b8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cmrw-7929-7rgj","advisory_id":"555978ea-feca-4526-a74b-a90c50f742b8","event_types":["advisory"],"published_at":"2026-10-26T01:31:25.836761+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T16:40:56+00:00","detail_url":"/events/73885"}]}},{"id":72884,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-9jq8-xmx2-9m25","summary":"CGA-9jq8-xmx2-9m25","evidence":"osv:CGA-9jq8-xmx2-9m25","products":[{"name":{"value":"elasticsearch-8.19-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9jq8-xmx2-9m25","aliases":["CGA-9jq8-xmx2-9m25"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-8.19-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-8.19-iamguarded-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9jq8-xmx2-9m25.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/opt/iamguarded/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-8.19.22.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:49:22Z"}]}}],"modified":"2026-10-03T10:32:37.891516230Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f1ffc28c-734c-4085-8d0e-72297c5b9088","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9jq8-xmx2-9m25","advisory_id":"f1ffc28c-734c-4085-8d0e-72297c5b9088","event_types":["advisory"],"published_at":"2026-10-26T01:26:07.268688+00:00","technologies":["core-osv","elasticsearch-8-19-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:56:08+00:00","detail_url":"/advisories/advisory%3Af1ffc28c-734c-4085-8d0e-72297c5b9088","group":{"id":"advisory:f1ffc28c-734c-4085-8d0e-72297c5b9088","revision":1,"primary_event_id":73831,"change":"published","superseded_by":[],"changed":{"id":73831,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-9jq8-xmx2-9m25","summary":"CGA-9jq8-xmx2-9m25","evidence":"osv:CGA-9jq8-xmx2-9m25","products":[{"name":{"value":"elasticsearch-8.19-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9jq8-xmx2-9m25","aliases":["CGA-9jq8-xmx2-9m25"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-8.19-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-8.19-iamguarded-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9jq8-xmx2-9m25.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/opt/iamguarded/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-8.19.22.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:49:22Z"}]}}],"modified":"2026-10-03T10:32:37.891516230Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f1ffc28c-734c-4085-8d0e-72297c5b9088","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9jq8-xmx2-9m25","advisory_id":"f1ffc28c-734c-4085-8d0e-72297c5b9088","event_types":["advisory"],"published_at":"2026-10-26T01:26:07.268688+00:00","technologies":["core-osv","elasticsearch-8-19-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:56:08+00:00","detail_url":"/events/73831"},"members":[{"id":73831,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-9jq8-xmx2-9m25","summary":"CGA-9jq8-xmx2-9m25","evidence":"osv:CGA-9jq8-xmx2-9m25","products":[{"name":{"value":"elasticsearch-8.19-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9jq8-xmx2-9m25","aliases":["CGA-9jq8-xmx2-9m25"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-8.19-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-8.19-iamguarded-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9jq8-xmx2-9m25.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/opt/iamguarded/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-8.19.22.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:49:22Z"}]}}],"modified":"2026-10-03T10:32:37.891516230Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f1ffc28c-734c-4085-8d0e-72297c5b9088","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9jq8-xmx2-9m25","advisory_id":"f1ffc28c-734c-4085-8d0e-72297c5b9088","event_types":["advisory"],"published_at":"2026-10-26T01:26:07.268688+00:00","technologies":["core-osv","elasticsearch-8-19-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:56:08+00:00","detail_url":"/events/73831"}]}},{"id":72855,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8pm6-c8h6-95pp","summary":"CGA-8pm6-c8h6-95pp","evidence":"osv:CGA-8pm6-c8h6-95pp","products":[{"name":{"value":"knative-kafka-broker-fips-1.22-receiver-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.3-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8pm6-c8h6-95pp","aliases":["CGA-8pm6-c8h6-95pp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r15"}]}],"package":{"name":"knative-kafka-broker-fips-1.22-receiver-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-fips-1.22-receiver-loom?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8pm6-c8h6-95pp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/app/libs/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:30:26Z"}]}}],"modified":"2026-10-03T10:32:36.784811707Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2822a0eb-2da6-4187-9997-c6ba44736fb3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8pm6-c8h6-95pp","advisory_id":"2822a0eb-2da6-4187-9997-c6ba44736fb3","event_types":["advisory"],"published_at":"2026-10-26T01:18:05.143001+00:00","technologies":["core-osv","knative-kafka-broker-fips-1-22-receiver-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:32:07+00:00","detail_url":"/advisories/advisory%3A2822a0eb-2da6-4187-9997-c6ba44736fb3","group":{"id":"advisory:2822a0eb-2da6-4187-9997-c6ba44736fb3","revision":1,"primary_event_id":73725,"change":"published","superseded_by":[],"changed":{"id":73725,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8pm6-c8h6-95pp","summary":"CGA-8pm6-c8h6-95pp","evidence":"osv:CGA-8pm6-c8h6-95pp","products":[{"name":{"value":"knative-kafka-broker-fips-1.22-receiver-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.3-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8pm6-c8h6-95pp","aliases":["CGA-8pm6-c8h6-95pp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r15"}]}],"package":{"name":"knative-kafka-broker-fips-1.22-receiver-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-fips-1.22-receiver-loom?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8pm6-c8h6-95pp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/app/libs/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:30:26Z"}]}}],"modified":"2026-10-03T10:32:36.784811707Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2822a0eb-2da6-4187-9997-c6ba44736fb3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8pm6-c8h6-95pp","advisory_id":"2822a0eb-2da6-4187-9997-c6ba44736fb3","event_types":["advisory"],"published_at":"2026-10-26T01:18:05.143001+00:00","technologies":["core-osv","knative-kafka-broker-fips-1-22-receiver-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:32:07+00:00","detail_url":"/events/73725"},"members":[{"id":73725,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8pm6-c8h6-95pp","summary":"CGA-8pm6-c8h6-95pp","evidence":"osv:CGA-8pm6-c8h6-95pp","products":[{"name":{"value":"knative-kafka-broker-fips-1.22-receiver-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.3-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8pm6-c8h6-95pp","aliases":["CGA-8pm6-c8h6-95pp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r15"}]}],"package":{"name":"knative-kafka-broker-fips-1.22-receiver-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-fips-1.22-receiver-loom?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8pm6-c8h6-95pp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/app/libs/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:30:26Z"}]}}],"modified":"2026-10-03T10:32:36.784811707Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2822a0eb-2da6-4187-9997-c6ba44736fb3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8pm6-c8h6-95pp","advisory_id":"2822a0eb-2da6-4187-9997-c6ba44736fb3","event_types":["advisory"],"published_at":"2026-10-26T01:18:05.143001+00:00","technologies":["core-osv","knative-kafka-broker-fips-1-22-receiver-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:32:07+00:00","detail_url":"/events/73725"}]}},{"id":72854,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8q7f-rmjr-vf5j","summary":"CGA-8q7f-rmjr-vf5j","evidence":"osv:CGA-8q7f-rmjr-vf5j","products":[{"name":{"value":"apache-tomee-microprofile","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"10.2.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8q7f-rmjr-vf5j","aliases":["CGA-8q7f-rmjr-vf5j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-r3"}]}],"package":{"name":"apache-tomee-microprofile","purl":"pkg:apk/chainguard/apache-tomee-microprofile?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8q7f-rmjr-vf5j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/tomee/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:25:53Z"}]}}],"modified":"2026-10-03T10:32:37.584133753Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1c520a0c-0541-4c4b-ac3c-7d864e15822a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8q7f-rmjr-vf5j","advisory_id":"1c520a0c-0541-4c4b-ac3c-7d864e15822a","event_types":["advisory"],"published_at":"2026-10-26T01:17:47.453143+00:00","technologies":["apache-tomee-microprofile","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:57:01+00:00","detail_url":"/advisories/advisory%3A1c520a0c-0541-4c4b-ac3c-7d864e15822a","group":{"id":"advisory:1c520a0c-0541-4c4b-ac3c-7d864e15822a","revision":1,"primary_event_id":73723,"change":"published","superseded_by":[],"changed":{"id":73723,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8q7f-rmjr-vf5j","summary":"CGA-8q7f-rmjr-vf5j","evidence":"osv:CGA-8q7f-rmjr-vf5j","products":[{"name":{"value":"apache-tomee-microprofile","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"10.2.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8q7f-rmjr-vf5j","aliases":["CGA-8q7f-rmjr-vf5j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-r3"}]}],"package":{"name":"apache-tomee-microprofile","purl":"pkg:apk/chainguard/apache-tomee-microprofile?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8q7f-rmjr-vf5j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/tomee/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:25:53Z"}]}}],"modified":"2026-10-03T10:32:37.584133753Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1c520a0c-0541-4c4b-ac3c-7d864e15822a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8q7f-rmjr-vf5j","advisory_id":"1c520a0c-0541-4c4b-ac3c-7d864e15822a","event_types":["advisory"],"published_at":"2026-10-26T01:17:47.453143+00:00","technologies":["apache-tomee-microprofile","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:57:01+00:00","detail_url":"/events/73723"},"members":[{"id":73723,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8q7f-rmjr-vf5j","summary":"CGA-8q7f-rmjr-vf5j","evidence":"osv:CGA-8q7f-rmjr-vf5j","products":[{"name":{"value":"apache-tomee-microprofile","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"10.2.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8q7f-rmjr-vf5j","aliases":["CGA-8q7f-rmjr-vf5j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-r3"}]}],"package":{"name":"apache-tomee-microprofile","purl":"pkg:apk/chainguard/apache-tomee-microprofile?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8q7f-rmjr-vf5j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/tomee/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:25:53Z"}]}}],"modified":"2026-10-03T10:32:37.584133753Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1c520a0c-0541-4c4b-ac3c-7d864e15822a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8q7f-rmjr-vf5j","advisory_id":"1c520a0c-0541-4c4b-ac3c-7d864e15822a","event_types":["advisory"],"published_at":"2026-10-26T01:17:47.453143+00:00","technologies":["apache-tomee-microprofile","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:57:01+00:00","detail_url":"/events/73723"}]}},{"id":72851,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-7fh3-j2r4-74vf","summary":"CGA-7fh3-j2r4-74vf","evidence":"osv:CGA-7fh3-j2r4-74vf","products":[{"name":{"value":"eco-java-gradle-7.3.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7fh3-j2r4-74vf","aliases":["CGA-7fh3-j2r4-74vf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-7.3.1","purl":"pkg:apk/chainguard/eco-java-gradle-7.3.1?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7fh3-j2r4-74vf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.12.1","component_type":"java-archive","component_version":"2.12.1","component_location":"/usr/lib/gradle/7.3.1/lib/plugins/jackson-core-2.12.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T01:25:52Z"}]}}],"modified":"2026-10-03T10:32:35.343310454Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f6c541d2-be8a-4490-bd5b-395c3312c8c5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7fh3-j2r4-74vf","advisory_id":"f6c541d2-be8a-4490-bd5b-395c3312c8c5","event_types":["advisory"],"published_at":"2026-10-26T01:17:08.328678+00:00","technologies":["core-osv","eco-java-gradle-7-3-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:46:27+00:00","detail_url":"/advisories/advisory%3Af6c541d2-be8a-4490-bd5b-395c3312c8c5","group":{"id":"advisory:f6c541d2-be8a-4490-bd5b-395c3312c8c5","revision":1,"primary_event_id":73717,"change":"published","superseded_by":[],"changed":{"id":73717,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-7fh3-j2r4-74vf","summary":"CGA-7fh3-j2r4-74vf","evidence":"osv:CGA-7fh3-j2r4-74vf","products":[{"name":{"value":"eco-java-gradle-7.3.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7fh3-j2r4-74vf","aliases":["CGA-7fh3-j2r4-74vf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-7.3.1","purl":"pkg:apk/chainguard/eco-java-gradle-7.3.1?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7fh3-j2r4-74vf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.12.1","component_type":"java-archive","component_version":"2.12.1","component_location":"/usr/lib/gradle/7.3.1/lib/plugins/jackson-core-2.12.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T01:25:52Z"}]}}],"modified":"2026-10-03T10:32:35.343310454Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f6c541d2-be8a-4490-bd5b-395c3312c8c5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7fh3-j2r4-74vf","advisory_id":"f6c541d2-be8a-4490-bd5b-395c3312c8c5","event_types":["advisory"],"published_at":"2026-10-26T01:17:08.328678+00:00","technologies":["core-osv","eco-java-gradle-7-3-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:46:27+00:00","detail_url":"/events/73717"},"members":[{"id":73717,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-7fh3-j2r4-74vf","summary":"CGA-7fh3-j2r4-74vf","evidence":"osv:CGA-7fh3-j2r4-74vf","products":[{"name":{"value":"eco-java-gradle-7.3.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7fh3-j2r4-74vf","aliases":["CGA-7fh3-j2r4-74vf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-7.3.1","purl":"pkg:apk/chainguard/eco-java-gradle-7.3.1?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7fh3-j2r4-74vf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.12.1","component_type":"java-archive","component_version":"2.12.1","component_location":"/usr/lib/gradle/7.3.1/lib/plugins/jackson-core-2.12.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T01:25:52Z"}]}}],"modified":"2026-10-03T10:32:35.343310454Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f6c541d2-be8a-4490-bd5b-395c3312c8c5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7fh3-j2r4-74vf","advisory_id":"f6c541d2-be8a-4490-bd5b-395c3312c8c5","event_types":["advisory"],"published_at":"2026-10-26T01:17:08.328678+00:00","technologies":["core-osv","eco-java-gradle-7-3-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:46:27+00:00","detail_url":"/events/73717"}]}},{"id":72848,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-97hp-mxqp-vjmh","summary":"CGA-97hp-mxqp-vjmh","evidence":"osv:CGA-97hp-mxqp-vjmh","products":[{"name":{"value":"eco-java-gradle-5.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-97hp-mxqp-vjmh","aliases":["CGA-97hp-mxqp-vjmh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-5.2","purl":"pkg:apk/chainguard/eco-java-gradle-5.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-97hp-mxqp-vjmh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.9.6","component_type":"java-archive","component_version":"2.9.6","component_location":"/usr/lib/gradle/5.2/lib/plugins/jackson-core-2.9.6.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T23:45:19Z"}]}}],"modified":"2026-10-03T10:32:37.589283231Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f9970d22-e9ca-46a2-a23e-df1332ad0465","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-97hp-mxqp-vjmh","advisory_id":"f9970d22-e9ca-46a2-a23e-df1332ad0465","event_types":["advisory"],"published_at":"2026-10-26T01:16:19.287973+00:00","technologies":["core-osv","eco-java-gradle-5-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:48:09+00:00","detail_url":"/advisories/advisory%3Af9970d22-e9ca-46a2-a23e-df1332ad0465","group":{"id":"advisory:f9970d22-e9ca-46a2-a23e-df1332ad0465","revision":1,"primary_event_id":73711,"change":"published","superseded_by":[],"changed":{"id":73711,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-97hp-mxqp-vjmh","summary":"CGA-97hp-mxqp-vjmh","evidence":"osv:CGA-97hp-mxqp-vjmh","products":[{"name":{"value":"eco-java-gradle-5.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-97hp-mxqp-vjmh","aliases":["CGA-97hp-mxqp-vjmh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-5.2","purl":"pkg:apk/chainguard/eco-java-gradle-5.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-97hp-mxqp-vjmh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.9.6","component_type":"java-archive","component_version":"2.9.6","component_location":"/usr/lib/gradle/5.2/lib/plugins/jackson-core-2.9.6.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T23:45:19Z"}]}}],"modified":"2026-10-03T10:32:37.589283231Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f9970d22-e9ca-46a2-a23e-df1332ad0465","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-97hp-mxqp-vjmh","advisory_id":"f9970d22-e9ca-46a2-a23e-df1332ad0465","event_types":["advisory"],"published_at":"2026-10-26T01:16:19.287973+00:00","technologies":["core-osv","eco-java-gradle-5-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:48:09+00:00","detail_url":"/events/73711"},"members":[{"id":73711,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-97hp-mxqp-vjmh","summary":"CGA-97hp-mxqp-vjmh","evidence":"osv:CGA-97hp-mxqp-vjmh","products":[{"name":{"value":"eco-java-gradle-5.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-97hp-mxqp-vjmh","aliases":["CGA-97hp-mxqp-vjmh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-5.2","purl":"pkg:apk/chainguard/eco-java-gradle-5.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-97hp-mxqp-vjmh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.9.6","component_type":"java-archive","component_version":"2.9.6","component_location":"/usr/lib/gradle/5.2/lib/plugins/jackson-core-2.9.6.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T23:45:19Z"}]}}],"modified":"2026-10-03T10:32:37.589283231Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f9970d22-e9ca-46a2-a23e-df1332ad0465","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-97hp-mxqp-vjmh","advisory_id":"f9970d22-e9ca-46a2-a23e-df1332ad0465","event_types":["advisory"],"published_at":"2026-10-26T01:16:19.287973+00:00","technologies":["core-osv","eco-java-gradle-5-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:48:09+00:00","detail_url":"/events/73711"}]}},{"id":72843,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-99cx-9g85-hf87","summary":"CGA-99cx-9g85-hf87","evidence":"osv:CGA-99cx-9g85-hf87","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-99cx-9g85-hf87","aliases":["CGA-99cx-9g85-hf87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-99cx-9g85-hf87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:07Z"}]}}],"modified":"2026-10-03T10:32:37.558148674Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bc6cbce5-94c4-422e-92b0-8313621d548e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-99cx-9g85-hf87","advisory_id":"bc6cbce5-94c4-422e-92b0-8313621d548e","event_types":["advisory"],"published_at":"2026-10-26T01:15:14.688468+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T16:53:00+00:00","detail_url":"/advisories/advisory%3Abc6cbce5-94c4-422e-92b0-8313621d548e","group":{"id":"advisory:bc6cbce5-94c4-422e-92b0-8313621d548e","revision":1,"primary_event_id":73701,"change":"published","superseded_by":[],"changed":{"id":73701,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-99cx-9g85-hf87","summary":"CGA-99cx-9g85-hf87","evidence":"osv:CGA-99cx-9g85-hf87","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-99cx-9g85-hf87","aliases":["CGA-99cx-9g85-hf87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-99cx-9g85-hf87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:07Z"}]}}],"modified":"2026-10-03T10:32:37.558148674Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bc6cbce5-94c4-422e-92b0-8313621d548e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-99cx-9g85-hf87","advisory_id":"bc6cbce5-94c4-422e-92b0-8313621d548e","event_types":["advisory"],"published_at":"2026-10-26T01:15:14.688468+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T16:53:00+00:00","detail_url":"/events/73701"},"members":[{"id":73701,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-99cx-9g85-hf87","summary":"CGA-99cx-9g85-hf87","evidence":"osv:CGA-99cx-9g85-hf87","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-99cx-9g85-hf87","aliases":["CGA-99cx-9g85-hf87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-99cx-9g85-hf87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:07Z"}]}}],"modified":"2026-10-03T10:32:37.558148674Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bc6cbce5-94c4-422e-92b0-8313621d548e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-99cx-9g85-hf87","advisory_id":"bc6cbce5-94c4-422e-92b0-8313621d548e","event_types":["advisory"],"published_at":"2026-10-26T01:15:14.688468+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T16:53:00+00:00","detail_url":"/events/73701"}]}},{"id":72842,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-9c69-fpcw-63j5","summary":"CGA-9c69-fpcw-63j5","evidence":"osv:CGA-9c69-fpcw-63j5","products":[{"name":{"value":"opensearch-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-notifications","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9c69-fpcw-63j5","aliases":["CGA-9c69-fpcw-63j5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-notifications","purl":"pkg:apk/chainguard/opensearch-3-notifications?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9c69-fpcw-63j5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:00:22Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-notifications","purl":"pkg:apk/wolfi/opensearch-3-notifications?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9c69-fpcw-63j5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:00:22Z"}]}}],"modified":"2026-10-03T10:32:37.564049128Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e8eaab72-0824-403b-a1a9-acf0f4155597","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9c69-fpcw-63j5","advisory_id":"e8eaab72-0824-403b-a1a9-acf0f4155597","event_types":["advisory"],"published_at":"2026-10-26T01:15:06.20758+00:00","technologies":["core-osv","opensearch-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:03:21+00:00","detail_url":"/advisories/advisory%3Ae8eaab72-0824-403b-a1a9-acf0f4155597","group":{"id":"advisory:e8eaab72-0824-403b-a1a9-acf0f4155597","revision":1,"primary_event_id":73700,"change":"published","superseded_by":[],"changed":{"id":73700,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-9c69-fpcw-63j5","summary":"CGA-9c69-fpcw-63j5","evidence":"osv:CGA-9c69-fpcw-63j5","products":[{"name":{"value":"opensearch-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-notifications","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9c69-fpcw-63j5","aliases":["CGA-9c69-fpcw-63j5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-notifications","purl":"pkg:apk/chainguard/opensearch-3-notifications?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9c69-fpcw-63j5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:00:22Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-notifications","purl":"pkg:apk/wolfi/opensearch-3-notifications?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9c69-fpcw-63j5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:00:22Z"}]}}],"modified":"2026-10-03T10:32:37.564049128Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e8eaab72-0824-403b-a1a9-acf0f4155597","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9c69-fpcw-63j5","advisory_id":"e8eaab72-0824-403b-a1a9-acf0f4155597","event_types":["advisory"],"published_at":"2026-10-26T01:15:06.20758+00:00","technologies":["core-osv","opensearch-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:03:21+00:00","detail_url":"/events/73700"},"members":[{"id":73700,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-9c69-fpcw-63j5","summary":"CGA-9c69-fpcw-63j5","evidence":"osv:CGA-9c69-fpcw-63j5","products":[{"name":{"value":"opensearch-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-notifications","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9c69-fpcw-63j5","aliases":["CGA-9c69-fpcw-63j5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-notifications","purl":"pkg:apk/chainguard/opensearch-3-notifications?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9c69-fpcw-63j5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:00:22Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-notifications","purl":"pkg:apk/wolfi/opensearch-3-notifications?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9c69-fpcw-63j5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:00:22Z"}]}}],"modified":"2026-10-03T10:32:37.564049128Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e8eaab72-0824-403b-a1a9-acf0f4155597","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9c69-fpcw-63j5","advisory_id":"e8eaab72-0824-403b-a1a9-acf0f4155597","event_types":["advisory"],"published_at":"2026-10-26T01:15:06.20758+00:00","technologies":["core-osv","opensearch-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:03:21+00:00","detail_url":"/events/73700"}]}},{"id":72838,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8c7v-m3mq-g22f","summary":"CGA-8c7v-m3mq-g22f","evidence":"osv:CGA-8c7v-m3mq-g22f","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8c7v-m3mq-g22f","aliases":["CGA-8c7v-m3mq-g22f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8c7v-m3mq-g22f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:04:17Z"}]}}],"modified":"2026-10-03T10:32:36.899134421Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3433d36c-46b5-4273-809f-a0c140325c5e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8c7v-m3mq-g22f","advisory_id":"3433d36c-46b5-4273-809f-a0c140325c5e","event_types":["advisory"],"published_at":"2026-10-26T01:14:19.535236+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:23:34+00:00","detail_url":"/advisories/advisory%3A3433d36c-46b5-4273-809f-a0c140325c5e","group":{"id":"advisory:3433d36c-46b5-4273-809f-a0c140325c5e","revision":1,"primary_event_id":73691,"change":"published","superseded_by":[],"changed":{"id":73691,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8c7v-m3mq-g22f","summary":"CGA-8c7v-m3mq-g22f","evidence":"osv:CGA-8c7v-m3mq-g22f","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8c7v-m3mq-g22f","aliases":["CGA-8c7v-m3mq-g22f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8c7v-m3mq-g22f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:04:17Z"}]}}],"modified":"2026-10-03T10:32:36.899134421Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3433d36c-46b5-4273-809f-a0c140325c5e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8c7v-m3mq-g22f","advisory_id":"3433d36c-46b5-4273-809f-a0c140325c5e","event_types":["advisory"],"published_at":"2026-10-26T01:14:19.535236+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:23:34+00:00","detail_url":"/events/73691"},"members":[{"id":73691,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8c7v-m3mq-g22f","summary":"CGA-8c7v-m3mq-g22f","evidence":"osv:CGA-8c7v-m3mq-g22f","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8c7v-m3mq-g22f","aliases":["CGA-8c7v-m3mq-g22f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8c7v-m3mq-g22f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:04:17Z"}]}}],"modified":"2026-10-03T10:32:36.899134421Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3433d36c-46b5-4273-809f-a0c140325c5e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8c7v-m3mq-g22f","advisory_id":"3433d36c-46b5-4273-809f-a0c140325c5e","event_types":["advisory"],"published_at":"2026-10-26T01:14:19.535236+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:23:34+00:00","detail_url":"/events/73691"}]}},{"id":72836,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8pr9-29v7-4gjh","summary":"CGA-8pr9-29v7-4gjh","evidence":"osv:CGA-8pr9-29v7-4gjh","products":[{"name":{"value":"strimzi-kafka-oauth-fips-m2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.18.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8pr9-29v7-4gjh","aliases":["CGA-8pr9-29v7-4gjh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-r3"}]}],"package":{"name":"strimzi-kafka-oauth-fips-m2","purl":"pkg:apk/chainguard/strimzi-kafka-oauth-fips-m2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8pr9-29v7-4gjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/m2/repository/io/strimzi/kafka-oauth-keycloak-authorizer/0.18.0/kafka-oauth-keycloak-authorizer-0.18.0.zip","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:06:08Z"}]}}],"modified":"2026-10-03T10:32:36.840737501Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e406fd77-cea6-4f7d-864b-e719dbe09907","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8pr9-29v7-4gjh","advisory_id":"e406fd77-cea6-4f7d-864b-e719dbe09907","event_types":["advisory"],"published_at":"2026-10-26T01:14:02.485999+00:00","technologies":["core-osv","strimzi-kafka-oauth-fips-m2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:10:59+00:00","detail_url":"/advisories/advisory%3Ae406fd77-cea6-4f7d-864b-e719dbe09907","group":{"id":"advisory:e406fd77-cea6-4f7d-864b-e719dbe09907","revision":1,"primary_event_id":73689,"change":"published","superseded_by":[],"changed":{"id":73689,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8pr9-29v7-4gjh","summary":"CGA-8pr9-29v7-4gjh","evidence":"osv:CGA-8pr9-29v7-4gjh","products":[{"name":{"value":"strimzi-kafka-oauth-fips-m2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.18.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8pr9-29v7-4gjh","aliases":["CGA-8pr9-29v7-4gjh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-r3"}]}],"package":{"name":"strimzi-kafka-oauth-fips-m2","purl":"pkg:apk/chainguard/strimzi-kafka-oauth-fips-m2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8pr9-29v7-4gjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/m2/repository/io/strimzi/kafka-oauth-keycloak-authorizer/0.18.0/kafka-oauth-keycloak-authorizer-0.18.0.zip","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:06:08Z"}]}}],"modified":"2026-10-03T10:32:36.840737501Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e406fd77-cea6-4f7d-864b-e719dbe09907","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8pr9-29v7-4gjh","advisory_id":"e406fd77-cea6-4f7d-864b-e719dbe09907","event_types":["advisory"],"published_at":"2026-10-26T01:14:02.485999+00:00","technologies":["core-osv","strimzi-kafka-oauth-fips-m2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:10:59+00:00","detail_url":"/events/73689"},"members":[{"id":73689,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8pr9-29v7-4gjh","summary":"CGA-8pr9-29v7-4gjh","evidence":"osv:CGA-8pr9-29v7-4gjh","products":[{"name":{"value":"strimzi-kafka-oauth-fips-m2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.18.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8pr9-29v7-4gjh","aliases":["CGA-8pr9-29v7-4gjh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-r3"}]}],"package":{"name":"strimzi-kafka-oauth-fips-m2","purl":"pkg:apk/chainguard/strimzi-kafka-oauth-fips-m2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8pr9-29v7-4gjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/m2/repository/io/strimzi/kafka-oauth-keycloak-authorizer/0.18.0/kafka-oauth-keycloak-authorizer-0.18.0.zip","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:06:08Z"}]}}],"modified":"2026-10-03T10:32:36.840737501Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e406fd77-cea6-4f7d-864b-e719dbe09907","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8pr9-29v7-4gjh","advisory_id":"e406fd77-cea6-4f7d-864b-e719dbe09907","event_types":["advisory"],"published_at":"2026-10-26T01:14:02.485999+00:00","technologies":["core-osv","strimzi-kafka-oauth-fips-m2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:10:59+00:00","detail_url":"/events/73689"}]}},{"id":72833,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-98g6-8fvp-88h3","summary":"CGA-98g6-8fvp-88h3","evidence":"osv:CGA-98g6-8fvp-88h3","products":[{"name":{"value":"eco-java-gradle-4.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-98g6-8fvp-88h3","aliases":["CGA-98g6-8fvp-88h3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-4.6","purl":"pkg:apk/chainguard/eco-java-gradle-4.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98g6-8fvp-88h3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.8.11","component_type":"java-archive","component_version":"2.8.11","component_location":"/usr/lib/gradle/4.6/lib/plugins/jackson-core-2.8.11.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T01:31:36Z"}]}}],"modified":"2026-10-03T10:32:37.545291993Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:15bba740-e715-46d0-aa97-355d9e87cf8e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98g6-8fvp-88h3","advisory_id":"15bba740-e715-46d0-aa97-355d9e87cf8e","event_types":["advisory"],"published_at":"2026-10-26T01:13:19.783629+00:00","technologies":["core-osv","eco-java-gradle-4-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:48:13+00:00","detail_url":"/advisories/advisory%3A15bba740-e715-46d0-aa97-355d9e87cf8e","group":{"id":"advisory:15bba740-e715-46d0-aa97-355d9e87cf8e","revision":1,"primary_event_id":73683,"change":"published","superseded_by":[],"changed":{"id":73683,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-98g6-8fvp-88h3","summary":"CGA-98g6-8fvp-88h3","evidence":"osv:CGA-98g6-8fvp-88h3","products":[{"name":{"value":"eco-java-gradle-4.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-98g6-8fvp-88h3","aliases":["CGA-98g6-8fvp-88h3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-4.6","purl":"pkg:apk/chainguard/eco-java-gradle-4.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98g6-8fvp-88h3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.8.11","component_type":"java-archive","component_version":"2.8.11","component_location":"/usr/lib/gradle/4.6/lib/plugins/jackson-core-2.8.11.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T01:31:36Z"}]}}],"modified":"2026-10-03T10:32:37.545291993Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:15bba740-e715-46d0-aa97-355d9e87cf8e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98g6-8fvp-88h3","advisory_id":"15bba740-e715-46d0-aa97-355d9e87cf8e","event_types":["advisory"],"published_at":"2026-10-26T01:13:19.783629+00:00","technologies":["core-osv","eco-java-gradle-4-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:48:13+00:00","detail_url":"/events/73683"},"members":[{"id":73683,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-98g6-8fvp-88h3","summary":"CGA-98g6-8fvp-88h3","evidence":"osv:CGA-98g6-8fvp-88h3","products":[{"name":{"value":"eco-java-gradle-4.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-98g6-8fvp-88h3","aliases":["CGA-98g6-8fvp-88h3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-4.6","purl":"pkg:apk/chainguard/eco-java-gradle-4.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98g6-8fvp-88h3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.8.11","component_type":"java-archive","component_version":"2.8.11","component_location":"/usr/lib/gradle/4.6/lib/plugins/jackson-core-2.8.11.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T01:31:36Z"}]}}],"modified":"2026-10-03T10:32:37.545291993Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:15bba740-e715-46d0-aa97-355d9e87cf8e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98g6-8fvp-88h3","advisory_id":"15bba740-e715-46d0-aa97-355d9e87cf8e","event_types":["advisory"],"published_at":"2026-10-26T01:13:19.783629+00:00","technologies":["core-osv","eco-java-gradle-4-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:48:13+00:00","detail_url":"/events/73683"}]}},{"id":72832,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-6rxh-rfqc-28rv","summary":"CGA-6rxh-rfqc-28rv","evidence":"osv:CGA-6rxh-rfqc-28rv","products":[{"name":{"value":"eco-java-gradle-7.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-6rxh-rfqc-28rv","aliases":["CGA-6rxh-rfqc-28rv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-7.1","purl":"pkg:apk/chainguard/eco-java-gradle-7.1?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6rxh-rfqc-28rv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.12.1","component_type":"java-archive","component_version":"2.12.1","component_location":"/usr/lib/gradle/7.1/lib/plugins/jackson-core-2.12.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:10:25Z"}]}}],"modified":"2026-10-03T10:32:34.914398813Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a977d54a-c846-45d5-9ba0-a786c73c5736","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6rxh-rfqc-28rv","advisory_id":"a977d54a-c846-45d5-9ba0-a786c73c5736","event_types":["advisory"],"published_at":"2026-10-26T01:13:11.449951+00:00","technologies":["core-osv","eco-java-gradle-7-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:59:50+00:00","detail_url":"/advisories/advisory%3Aa977d54a-c846-45d5-9ba0-a786c73c5736","group":{"id":"advisory:a977d54a-c846-45d5-9ba0-a786c73c5736","revision":1,"primary_event_id":73682,"change":"published","superseded_by":[],"changed":{"id":73682,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-6rxh-rfqc-28rv","summary":"CGA-6rxh-rfqc-28rv","evidence":"osv:CGA-6rxh-rfqc-28rv","products":[{"name":{"value":"eco-java-gradle-7.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-6rxh-rfqc-28rv","aliases":["CGA-6rxh-rfqc-28rv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-7.1","purl":"pkg:apk/chainguard/eco-java-gradle-7.1?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6rxh-rfqc-28rv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.12.1","component_type":"java-archive","component_version":"2.12.1","component_location":"/usr/lib/gradle/7.1/lib/plugins/jackson-core-2.12.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:10:25Z"}]}}],"modified":"2026-10-03T10:32:34.914398813Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a977d54a-c846-45d5-9ba0-a786c73c5736","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6rxh-rfqc-28rv","advisory_id":"a977d54a-c846-45d5-9ba0-a786c73c5736","event_types":["advisory"],"published_at":"2026-10-26T01:13:11.449951+00:00","technologies":["core-osv","eco-java-gradle-7-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:59:50+00:00","detail_url":"/events/73682"},"members":[{"id":73682,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-6rxh-rfqc-28rv","summary":"CGA-6rxh-rfqc-28rv","evidence":"osv:CGA-6rxh-rfqc-28rv","products":[{"name":{"value":"eco-java-gradle-7.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-6rxh-rfqc-28rv","aliases":["CGA-6rxh-rfqc-28rv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-7.1","purl":"pkg:apk/chainguard/eco-java-gradle-7.1?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6rxh-rfqc-28rv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.12.1","component_type":"java-archive","component_version":"2.12.1","component_location":"/usr/lib/gradle/7.1/lib/plugins/jackson-core-2.12.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:10:25Z"}]}}],"modified":"2026-10-03T10:32:34.914398813Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a977d54a-c846-45d5-9ba0-a786c73c5736","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6rxh-rfqc-28rv","advisory_id":"a977d54a-c846-45d5-9ba0-a786c73c5736","event_types":["advisory"],"published_at":"2026-10-26T01:13:11.449951+00:00","technologies":["core-osv","eco-java-gradle-7-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:59:50+00:00","detail_url":"/events/73682"}]}},{"id":72817,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8c3m-g42p-cr3v","summary":"CGA-8c3m-g42p-cr3v","evidence":"osv:CGA-8c3m-g42p-cr3v","products":[{"name":{"value":"eco-java-gradle-8.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8c3m-g42p-cr3v","aliases":["CGA-8c3m-g42p-cr3v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.4","purl":"pkg:apk/chainguard/eco-java-gradle-8.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8c3m-g42p-cr3v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.14.1","component_type":"java-archive","component_version":"2.14.1","component_location":"/usr/lib/gradle/8.4/lib/plugins/jackson-core-2.14.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:31:13Z"}]}}],"modified":"2026-10-03T10:32:36.536029061Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:17933539-c5ce-4f91-82fc-f9c8e9511a66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8c3m-g42p-cr3v","advisory_id":"17933539-c5ce-4f91-82fc-f9c8e9511a66","event_types":["advisory"],"published_at":"2026-10-26T01:11:00.107925+00:00","technologies":["core-osv","eco-java-gradle-8-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:00:03+00:00","detail_url":"/advisories/advisory%3A17933539-c5ce-4f91-82fc-f9c8e9511a66","group":{"id":"advisory:17933539-c5ce-4f91-82fc-f9c8e9511a66","revision":1,"primary_event_id":73656,"change":"published","superseded_by":[],"changed":{"id":73656,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8c3m-g42p-cr3v","summary":"CGA-8c3m-g42p-cr3v","evidence":"osv:CGA-8c3m-g42p-cr3v","products":[{"name":{"value":"eco-java-gradle-8.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8c3m-g42p-cr3v","aliases":["CGA-8c3m-g42p-cr3v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.4","purl":"pkg:apk/chainguard/eco-java-gradle-8.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8c3m-g42p-cr3v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.14.1","component_type":"java-archive","component_version":"2.14.1","component_location":"/usr/lib/gradle/8.4/lib/plugins/jackson-core-2.14.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:31:13Z"}]}}],"modified":"2026-10-03T10:32:36.536029061Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:17933539-c5ce-4f91-82fc-f9c8e9511a66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8c3m-g42p-cr3v","advisory_id":"17933539-c5ce-4f91-82fc-f9c8e9511a66","event_types":["advisory"],"published_at":"2026-10-26T01:11:00.107925+00:00","technologies":["core-osv","eco-java-gradle-8-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:00:03+00:00","detail_url":"/events/73656"},"members":[{"id":73656,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8c3m-g42p-cr3v","summary":"CGA-8c3m-g42p-cr3v","evidence":"osv:CGA-8c3m-g42p-cr3v","products":[{"name":{"value":"eco-java-gradle-8.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8c3m-g42p-cr3v","aliases":["CGA-8c3m-g42p-cr3v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.4","purl":"pkg:apk/chainguard/eco-java-gradle-8.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8c3m-g42p-cr3v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.14.1","component_type":"java-archive","component_version":"2.14.1","component_location":"/usr/lib/gradle/8.4/lib/plugins/jackson-core-2.14.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:31:13Z"}]}}],"modified":"2026-10-03T10:32:36.536029061Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:17933539-c5ce-4f91-82fc-f9c8e9511a66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8c3m-g42p-cr3v","advisory_id":"17933539-c5ce-4f91-82fc-f9c8e9511a66","event_types":["advisory"],"published_at":"2026-10-26T01:11:00.107925+00:00","technologies":["core-osv","eco-java-gradle-8-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:00:03+00:00","detail_url":"/events/73656"}]}},{"id":72816,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8296-f388-pj83","summary":"CGA-8296-f388-pj83","evidence":"osv:CGA-8296-f388-pj83","products":[{"name":{"value":"strimzi-kafka-oauth-fips-m2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.18.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8296-f388-pj83","aliases":["CGA-8296-f388-pj83"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-r3"}]}],"package":{"name":"strimzi-kafka-oauth-fips-m2","purl":"pkg:apk/chainguard/strimzi-kafka-oauth-fips-m2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8296-f388-pj83.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/m2/repository/io/strimzi/kafka-oauth-keycloak-authorizer/0.18.0/kafka-oauth-keycloak-authorizer-0.18.0.zip","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:34:59Z"}]}}],"modified":"2026-10-03T10:32:35.912494781Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3f86daf6-193e-4bcb-ae90-41aba469c58e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8296-f388-pj83","advisory_id":"3f86daf6-193e-4bcb-ae90-41aba469c58e","event_types":["advisory"],"published_at":"2026-10-26T01:10:51.811198+00:00","technologies":["core-osv","strimzi-kafka-oauth-fips-m2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:58:01+00:00","detail_url":"/advisories/advisory%3A3f86daf6-193e-4bcb-ae90-41aba469c58e","group":{"id":"advisory:3f86daf6-193e-4bcb-ae90-41aba469c58e","revision":1,"primary_event_id":73655,"change":"published","superseded_by":[],"changed":{"id":73655,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8296-f388-pj83","summary":"CGA-8296-f388-pj83","evidence":"osv:CGA-8296-f388-pj83","products":[{"name":{"value":"strimzi-kafka-oauth-fips-m2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.18.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8296-f388-pj83","aliases":["CGA-8296-f388-pj83"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-r3"}]}],"package":{"name":"strimzi-kafka-oauth-fips-m2","purl":"pkg:apk/chainguard/strimzi-kafka-oauth-fips-m2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8296-f388-pj83.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/m2/repository/io/strimzi/kafka-oauth-keycloak-authorizer/0.18.0/kafka-oauth-keycloak-authorizer-0.18.0.zip","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:34:59Z"}]}}],"modified":"2026-10-03T10:32:35.912494781Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3f86daf6-193e-4bcb-ae90-41aba469c58e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8296-f388-pj83","advisory_id":"3f86daf6-193e-4bcb-ae90-41aba469c58e","event_types":["advisory"],"published_at":"2026-10-26T01:10:51.811198+00:00","technologies":["core-osv","strimzi-kafka-oauth-fips-m2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:58:01+00:00","detail_url":"/events/73655"},"members":[{"id":73655,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8296-f388-pj83","summary":"CGA-8296-f388-pj83","evidence":"osv:CGA-8296-f388-pj83","products":[{"name":{"value":"strimzi-kafka-oauth-fips-m2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.18.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8296-f388-pj83","aliases":["CGA-8296-f388-pj83"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-r3"}]}],"package":{"name":"strimzi-kafka-oauth-fips-m2","purl":"pkg:apk/chainguard/strimzi-kafka-oauth-fips-m2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8296-f388-pj83.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/m2/repository/io/strimzi/kafka-oauth-keycloak-authorizer/0.18.0/kafka-oauth-keycloak-authorizer-0.18.0.zip","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:34:59Z"}]}}],"modified":"2026-10-03T10:32:35.912494781Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3f86daf6-193e-4bcb-ae90-41aba469c58e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8296-f388-pj83","advisory_id":"3f86daf6-193e-4bcb-ae90-41aba469c58e","event_types":["advisory"],"published_at":"2026-10-26T01:10:51.811198+00:00","technologies":["core-osv","strimzi-kafka-oauth-fips-m2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:58:01+00:00","detail_url":"/events/73655"}]}},{"id":72815,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8mvc-7v6c-q8jw","summary":"CGA-8mvc-7v6c-q8jw","evidence":"osv:CGA-8mvc-7v6c-q8jw","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8mvc-7v6c-q8jw","aliases":["CGA-8mvc-7v6c-q8jw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8mvc-7v6c-q8jw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-8.19.22.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:04:18Z"}]}}],"modified":"2026-10-03T10:32:36.775273743Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4ad4e7e8-4284-4011-b1fa-cda0826a4d0f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8mvc-7v6c-q8jw","advisory_id":"4ad4e7e8-4284-4011-b1fa-cda0826a4d0f","event_types":["advisory"],"published_at":"2026-10-26T01:10:24.89792+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:23:32+00:00","detail_url":"/advisories/advisory%3A4ad4e7e8-4284-4011-b1fa-cda0826a4d0f","group":{"id":"advisory:4ad4e7e8-4284-4011-b1fa-cda0826a4d0f","revision":1,"primary_event_id":73652,"change":"published","superseded_by":[],"changed":{"id":73652,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8mvc-7v6c-q8jw","summary":"CGA-8mvc-7v6c-q8jw","evidence":"osv:CGA-8mvc-7v6c-q8jw","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8mvc-7v6c-q8jw","aliases":["CGA-8mvc-7v6c-q8jw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8mvc-7v6c-q8jw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-8.19.22.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:04:18Z"}]}}],"modified":"2026-10-03T10:32:36.775273743Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4ad4e7e8-4284-4011-b1fa-cda0826a4d0f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8mvc-7v6c-q8jw","advisory_id":"4ad4e7e8-4284-4011-b1fa-cda0826a4d0f","event_types":["advisory"],"published_at":"2026-10-26T01:10:24.89792+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:23:32+00:00","detail_url":"/events/73652"},"members":[{"id":73652,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8mvc-7v6c-q8jw","summary":"CGA-8mvc-7v6c-q8jw","evidence":"osv:CGA-8mvc-7v6c-q8jw","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8mvc-7v6c-q8jw","aliases":["CGA-8mvc-7v6c-q8jw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8mvc-7v6c-q8jw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-8.19.22.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:04:18Z"}]}}],"modified":"2026-10-03T10:32:36.775273743Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4ad4e7e8-4284-4011-b1fa-cda0826a4d0f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8mvc-7v6c-q8jw","advisory_id":"4ad4e7e8-4284-4011-b1fa-cda0826a4d0f","event_types":["advisory"],"published_at":"2026-10-26T01:10:24.89792+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:23:32+00:00","detail_url":"/events/73652"}]}},{"id":72813,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-85ph-wjx3-8xr7","summary":"CGA-85ph-wjx3-8xr7","evidence":"osv:CGA-85ph-wjx3-8xr7","products":[{"name":{"value":"apache-tomee-plume","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"10.2.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-85ph-wjx3-8xr7","aliases":["CGA-85ph-wjx3-8xr7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-r3"}]}],"package":{"name":"apache-tomee-plume","purl":"pkg:apk/chainguard/apache-tomee-plume?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-85ph-wjx3-8xr7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/tomee/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:03:18Z"}]}}],"modified":"2026-10-03T10:32:36.154282426Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e41c7675-2513-4fa4-a5a1-20ceb98b3e16","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-85ph-wjx3-8xr7","advisory_id":"e41c7675-2513-4fa4-a5a1-20ceb98b3e16","event_types":["advisory"],"published_at":"2026-10-26T01:10:11.726379+00:00","technologies":["apache-tomee-plume","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:48:29+00:00","detail_url":"/advisories/advisory%3Ae41c7675-2513-4fa4-a5a1-20ceb98b3e16","group":{"id":"advisory:e41c7675-2513-4fa4-a5a1-20ceb98b3e16","revision":1,"primary_event_id":73650,"change":"published","superseded_by":[],"changed":{"id":73650,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-85ph-wjx3-8xr7","summary":"CGA-85ph-wjx3-8xr7","evidence":"osv:CGA-85ph-wjx3-8xr7","products":[{"name":{"value":"apache-tomee-plume","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"10.2.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-85ph-wjx3-8xr7","aliases":["CGA-85ph-wjx3-8xr7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-r3"}]}],"package":{"name":"apache-tomee-plume","purl":"pkg:apk/chainguard/apache-tomee-plume?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-85ph-wjx3-8xr7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/tomee/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:03:18Z"}]}}],"modified":"2026-10-03T10:32:36.154282426Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e41c7675-2513-4fa4-a5a1-20ceb98b3e16","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-85ph-wjx3-8xr7","advisory_id":"e41c7675-2513-4fa4-a5a1-20ceb98b3e16","event_types":["advisory"],"published_at":"2026-10-26T01:10:11.726379+00:00","technologies":["apache-tomee-plume","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:48:29+00:00","detail_url":"/events/73650"},"members":[{"id":73650,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-85ph-wjx3-8xr7","summary":"CGA-85ph-wjx3-8xr7","evidence":"osv:CGA-85ph-wjx3-8xr7","products":[{"name":{"value":"apache-tomee-plume","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"10.2.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-85ph-wjx3-8xr7","aliases":["CGA-85ph-wjx3-8xr7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-r3"}]}],"package":{"name":"apache-tomee-plume","purl":"pkg:apk/chainguard/apache-tomee-plume?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-85ph-wjx3-8xr7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/tomee/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:03:18Z"}]}}],"modified":"2026-10-03T10:32:36.154282426Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e41c7675-2513-4fa4-a5a1-20ceb98b3e16","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-85ph-wjx3-8xr7","advisory_id":"e41c7675-2513-4fa4-a5a1-20ceb98b3e16","event_types":["advisory"],"published_at":"2026-10-26T01:10:11.726379+00:00","technologies":["apache-tomee-plume","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:48:29+00:00","detail_url":"/events/73650"}]}},{"id":72812,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-689p-2qq7-3958","summary":"CGA-689p-2qq7-3958","evidence":"osv:CGA-689p-2qq7-3958","products":[{"name":{"value":"eco-java-gradle-8.14.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-689p-2qq7-3958","aliases":["CGA-689p-2qq7-3958"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.14.1","purl":"pkg:apk/chainguard/eco-java-gradle-8.14.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-689p-2qq7-3958.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/usr/lib/gradle/8.14.1/lib/jackson-core-2.16.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:30:09Z"}]}}],"modified":"2026-10-03T10:32:34.198657793Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:80cfc2e6-cd05-4659-975d-cbd67981f14f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-689p-2qq7-3958","advisory_id":"80cfc2e6-cd05-4659-975d-cbd67981f14f","event_types":["advisory"],"published_at":"2026-10-26T01:10:02.766267+00:00","technologies":["core-osv","eco-java-gradle-8-14-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:51:14+00:00","detail_url":"/advisories/advisory%3A80cfc2e6-cd05-4659-975d-cbd67981f14f","group":{"id":"advisory:80cfc2e6-cd05-4659-975d-cbd67981f14f","revision":1,"primary_event_id":73649,"change":"published","superseded_by":[],"changed":{"id":73649,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-689p-2qq7-3958","summary":"CGA-689p-2qq7-3958","evidence":"osv:CGA-689p-2qq7-3958","products":[{"name":{"value":"eco-java-gradle-8.14.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-689p-2qq7-3958","aliases":["CGA-689p-2qq7-3958"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.14.1","purl":"pkg:apk/chainguard/eco-java-gradle-8.14.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-689p-2qq7-3958.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/usr/lib/gradle/8.14.1/lib/jackson-core-2.16.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:30:09Z"}]}}],"modified":"2026-10-03T10:32:34.198657793Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:80cfc2e6-cd05-4659-975d-cbd67981f14f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-689p-2qq7-3958","advisory_id":"80cfc2e6-cd05-4659-975d-cbd67981f14f","event_types":["advisory"],"published_at":"2026-10-26T01:10:02.766267+00:00","technologies":["core-osv","eco-java-gradle-8-14-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:51:14+00:00","detail_url":"/events/73649"},"members":[{"id":73649,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-689p-2qq7-3958","summary":"CGA-689p-2qq7-3958","evidence":"osv:CGA-689p-2qq7-3958","products":[{"name":{"value":"eco-java-gradle-8.14.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-689p-2qq7-3958","aliases":["CGA-689p-2qq7-3958"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.14.1","purl":"pkg:apk/chainguard/eco-java-gradle-8.14.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-689p-2qq7-3958.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/usr/lib/gradle/8.14.1/lib/jackson-core-2.16.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:30:09Z"}]}}],"modified":"2026-10-03T10:32:34.198657793Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:80cfc2e6-cd05-4659-975d-cbd67981f14f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-689p-2qq7-3958","advisory_id":"80cfc2e6-cd05-4659-975d-cbd67981f14f","event_types":["advisory"],"published_at":"2026-10-26T01:10:02.766267+00:00","technologies":["core-osv","eco-java-gradle-8-14-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:51:14+00:00","detail_url":"/events/73649"}]}},{"id":72811,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-86r7-2rjr-5qj5","summary":"CGA-86r7-2rjr-5qj5","evidence":"osv:CGA-86r7-2rjr-5qj5","products":[{"name":{"value":"hadoop-fips-3.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.0-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-86r7-2rjr-5qj5","aliases":["CGA-86r7-2rjr-5qj5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-r18"}]}],"package":{"name":"hadoop-fips-3.5","purl":"pkg:apk/chainguard/hadoop-fips-3.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-86r7-2rjr-5qj5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/m2/repository/org/apache/hadoop/hadoop-benchmark/3.5.0/hadoop-benchmark-3.5.0-uber.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:57:16Z"}]}}],"modified":"2026-10-03T10:32:36.123746359Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a331a3e8-7b4c-48b4-8714-2779e8a6bc3a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-86r7-2rjr-5qj5","advisory_id":"a331a3e8-7b4c-48b4-8714-2779e8a6bc3a","event_types":["advisory"],"published_at":"2026-10-26T01:09:54.034548+00:00","technologies":["core-osv","hadoop-fips-3-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:49:02+00:00","detail_url":"/advisories/advisory%3Aa331a3e8-7b4c-48b4-8714-2779e8a6bc3a","group":{"id":"advisory:a331a3e8-7b4c-48b4-8714-2779e8a6bc3a","revision":1,"primary_event_id":73648,"change":"published","superseded_by":[],"changed":{"id":73648,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-86r7-2rjr-5qj5","summary":"CGA-86r7-2rjr-5qj5","evidence":"osv:CGA-86r7-2rjr-5qj5","products":[{"name":{"value":"hadoop-fips-3.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.0-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-86r7-2rjr-5qj5","aliases":["CGA-86r7-2rjr-5qj5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-r18"}]}],"package":{"name":"hadoop-fips-3.5","purl":"pkg:apk/chainguard/hadoop-fips-3.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-86r7-2rjr-5qj5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/m2/repository/org/apache/hadoop/hadoop-benchmark/3.5.0/hadoop-benchmark-3.5.0-uber.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:57:16Z"}]}}],"modified":"2026-10-03T10:32:36.123746359Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a331a3e8-7b4c-48b4-8714-2779e8a6bc3a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-86r7-2rjr-5qj5","advisory_id":"a331a3e8-7b4c-48b4-8714-2779e8a6bc3a","event_types":["advisory"],"published_at":"2026-10-26T01:09:54.034548+00:00","technologies":["core-osv","hadoop-fips-3-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:49:02+00:00","detail_url":"/events/73648"},"members":[{"id":73648,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-86r7-2rjr-5qj5","summary":"CGA-86r7-2rjr-5qj5","evidence":"osv:CGA-86r7-2rjr-5qj5","products":[{"name":{"value":"hadoop-fips-3.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.0-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-86r7-2rjr-5qj5","aliases":["CGA-86r7-2rjr-5qj5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-r18"}]}],"package":{"name":"hadoop-fips-3.5","purl":"pkg:apk/chainguard/hadoop-fips-3.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-86r7-2rjr-5qj5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/m2/repository/org/apache/hadoop/hadoop-benchmark/3.5.0/hadoop-benchmark-3.5.0-uber.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:57:16Z"}]}}],"modified":"2026-10-03T10:32:36.123746359Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a331a3e8-7b4c-48b4-8714-2779e8a6bc3a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-86r7-2rjr-5qj5","advisory_id":"a331a3e8-7b4c-48b4-8714-2779e8a6bc3a","event_types":["advisory"],"published_at":"2026-10-26T01:09:54.034548+00:00","technologies":["core-osv","hadoop-fips-3-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:49:02+00:00","detail_url":"/events/73648"}]}},{"id":72804,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-89jh-vm4g-8gcc","summary":"CGA-89jh-vm4g-8gcc","evidence":"osv:CGA-89jh-vm4g-8gcc","products":[{"name":{"value":"opensearch-3-discovery-gce","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-discovery-gce","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-89jh-vm4g-8gcc","aliases":["CGA-89jh-vm4g-8gcc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-gce","purl":"pkg:apk/chainguard/opensearch-3-discovery-gce?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-89jh-vm4g-8gcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-gce/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:49:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-gce","purl":"pkg:apk/wolfi/opensearch-3-discovery-gce?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-89jh-vm4g-8gcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-gce/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:49:07Z"}]}}],"modified":"2026-10-03T10:32:36.515112528Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a400cec6-4c9a-470a-bbeb-121d7c3b4fa2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-89jh-vm4g-8gcc","advisory_id":"a400cec6-4c9a-470a-bbeb-121d7c3b4fa2","event_types":["advisory"],"published_at":"2026-10-26T01:08:19.135238+00:00","technologies":["core-osv","opensearch-3-discovery-gce"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:07:47+00:00","detail_url":"/advisories/advisory%3Aa400cec6-4c9a-470a-bbeb-121d7c3b4fa2","group":{"id":"advisory:a400cec6-4c9a-470a-bbeb-121d7c3b4fa2","revision":1,"primary_event_id":73629,"change":"published","superseded_by":[],"changed":{"id":73629,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-89jh-vm4g-8gcc","summary":"CGA-89jh-vm4g-8gcc","evidence":"osv:CGA-89jh-vm4g-8gcc","products":[{"name":{"value":"opensearch-3-discovery-gce","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-discovery-gce","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-89jh-vm4g-8gcc","aliases":["CGA-89jh-vm4g-8gcc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-gce","purl":"pkg:apk/chainguard/opensearch-3-discovery-gce?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-89jh-vm4g-8gcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-gce/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:49:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-gce","purl":"pkg:apk/wolfi/opensearch-3-discovery-gce?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-89jh-vm4g-8gcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-gce/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:49:07Z"}]}}],"modified":"2026-10-03T10:32:36.515112528Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a400cec6-4c9a-470a-bbeb-121d7c3b4fa2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-89jh-vm4g-8gcc","advisory_id":"a400cec6-4c9a-470a-bbeb-121d7c3b4fa2","event_types":["advisory"],"published_at":"2026-10-26T01:08:19.135238+00:00","technologies":["core-osv","opensearch-3-discovery-gce"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:07:47+00:00","detail_url":"/events/73629"},"members":[{"id":73629,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-89jh-vm4g-8gcc","summary":"CGA-89jh-vm4g-8gcc","evidence":"osv:CGA-89jh-vm4g-8gcc","products":[{"name":{"value":"opensearch-3-discovery-gce","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-discovery-gce","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-89jh-vm4g-8gcc","aliases":["CGA-89jh-vm4g-8gcc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-gce","purl":"pkg:apk/chainguard/opensearch-3-discovery-gce?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-89jh-vm4g-8gcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-gce/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:49:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-gce","purl":"pkg:apk/wolfi/opensearch-3-discovery-gce?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-89jh-vm4g-8gcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-gce/jackson-core-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:49:07Z"}]}}],"modified":"2026-10-03T10:32:36.515112528Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a400cec6-4c9a-470a-bbeb-121d7c3b4fa2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-89jh-vm4g-8gcc","advisory_id":"a400cec6-4c9a-470a-bbeb-121d7c3b4fa2","event_types":["advisory"],"published_at":"2026-10-26T01:08:19.135238+00:00","technologies":["core-osv","opensearch-3-discovery-gce"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:07:47+00:00","detail_url":"/events/73629"}]}},{"id":72798,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-84jm-whvr-gm2v","summary":"CGA-84jm-whvr-gm2v","evidence":"osv:CGA-84jm-whvr-gm2v","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-84jm-whvr-gm2v","aliases":["CGA-84jm-whvr-gm2v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-84jm-whvr-gm2v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:56:16Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-84jm-whvr-gm2v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:56:16Z"}]}}],"modified":"2026-10-03T10:32:35.923746096Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0829e7a8-d3e9-4dd4-b81b-4c746631b396","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-84jm-whvr-gm2v","advisory_id":"0829e7a8-d3e9-4dd4-b81b-4c746631b396","event_types":["advisory"],"published_at":"2026-10-26T01:07:48.905931+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:34:02+00:00","detail_url":"/advisories/advisory%3A0829e7a8-d3e9-4dd4-b81b-4c746631b396","group":{"id":"advisory:0829e7a8-d3e9-4dd4-b81b-4c746631b396","revision":1,"primary_event_id":73622,"change":"published","superseded_by":[],"changed":{"id":73622,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-84jm-whvr-gm2v","summary":"CGA-84jm-whvr-gm2v","evidence":"osv:CGA-84jm-whvr-gm2v","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-84jm-whvr-gm2v","aliases":["CGA-84jm-whvr-gm2v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-84jm-whvr-gm2v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:56:16Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-84jm-whvr-gm2v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:56:16Z"}]}}],"modified":"2026-10-03T10:32:35.923746096Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0829e7a8-d3e9-4dd4-b81b-4c746631b396","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-84jm-whvr-gm2v","advisory_id":"0829e7a8-d3e9-4dd4-b81b-4c746631b396","event_types":["advisory"],"published_at":"2026-10-26T01:07:48.905931+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:34:02+00:00","detail_url":"/events/73622"},"members":[{"id":73622,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-84jm-whvr-gm2v","summary":"CGA-84jm-whvr-gm2v","evidence":"osv:CGA-84jm-whvr-gm2v","products":[{"name":{"value":"opensearch-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-84jm-whvr-gm2v","aliases":["CGA-84jm-whvr-gm2v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/chainguard/opensearch-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-84jm-whvr-gm2v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:56:16Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2","purl":"pkg:apk/wolfi/opensearch-2?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-84jm-whvr-gm2v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/lib/jackson-core-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:56:16Z"}]}}],"modified":"2026-10-03T10:32:35.923746096Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0829e7a8-d3e9-4dd4-b81b-4c746631b396","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-84jm-whvr-gm2v","advisory_id":"0829e7a8-d3e9-4dd4-b81b-4c746631b396","event_types":["advisory"],"published_at":"2026-10-26T01:07:48.905931+00:00","technologies":["core-osv","opensearch-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:34:02+00:00","detail_url":"/events/73622"}]}},{"id":72795,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-852w-pvvp-mc72","summary":"CGA-852w-pvvp-mc72","evidence":"osv:CGA-852w-pvvp-mc72","products":[{"name":{"value":"eco-java-gradle-8.11.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-852w-pvvp-mc72","aliases":["CGA-852w-pvvp-mc72"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.11.1","purl":"pkg:apk/chainguard/eco-java-gradle-8.11.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-852w-pvvp-mc72.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/usr/lib/gradle/8.11.1/lib/jackson-core-2.16.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:38:39Z"}]}}],"modified":"2026-10-03T10:32:36.095027007Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:65d0017c-7cad-4aa7-b1c7-a589aa75c7a4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-852w-pvvp-mc72","advisory_id":"65d0017c-7cad-4aa7-b1c7-a589aa75c7a4","event_types":["advisory"],"published_at":"2026-10-26T01:07:25.435599+00:00","technologies":["core-osv","eco-java-gradle-8-11-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:57:25+00:00","detail_url":"/advisories/advisory%3A65d0017c-7cad-4aa7-b1c7-a589aa75c7a4","group":{"id":"advisory:65d0017c-7cad-4aa7-b1c7-a589aa75c7a4","revision":1,"primary_event_id":73618,"change":"published","superseded_by":[],"changed":{"id":73618,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-852w-pvvp-mc72","summary":"CGA-852w-pvvp-mc72","evidence":"osv:CGA-852w-pvvp-mc72","products":[{"name":{"value":"eco-java-gradle-8.11.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-852w-pvvp-mc72","aliases":["CGA-852w-pvvp-mc72"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.11.1","purl":"pkg:apk/chainguard/eco-java-gradle-8.11.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-852w-pvvp-mc72.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/usr/lib/gradle/8.11.1/lib/jackson-core-2.16.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:38:39Z"}]}}],"modified":"2026-10-03T10:32:36.095027007Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:65d0017c-7cad-4aa7-b1c7-a589aa75c7a4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-852w-pvvp-mc72","advisory_id":"65d0017c-7cad-4aa7-b1c7-a589aa75c7a4","event_types":["advisory"],"published_at":"2026-10-26T01:07:25.435599+00:00","technologies":["core-osv","eco-java-gradle-8-11-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:57:25+00:00","detail_url":"/events/73618"},"members":[{"id":73618,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-852w-pvvp-mc72","summary":"CGA-852w-pvvp-mc72","evidence":"osv:CGA-852w-pvvp-mc72","products":[{"name":{"value":"eco-java-gradle-8.11.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-852w-pvvp-mc72","aliases":["CGA-852w-pvvp-mc72"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.11.1","purl":"pkg:apk/chainguard/eco-java-gradle-8.11.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-852w-pvvp-mc72.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/usr/lib/gradle/8.11.1/lib/jackson-core-2.16.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-03T00:38:39Z"}]}}],"modified":"2026-10-03T10:32:36.095027007Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:65d0017c-7cad-4aa7-b1c7-a589aa75c7a4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-852w-pvvp-mc72","advisory_id":"65d0017c-7cad-4aa7-b1c7-a589aa75c7a4","event_types":["advisory"],"published_at":"2026-10-26T01:07:25.435599+00:00","technologies":["core-osv","eco-java-gradle-8-11-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:57:25+00:00","detail_url":"/events/73618"}]}},{"id":72791,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-82hh-mpjm-p665","summary":"CGA-82hh-mpjm-p665","evidence":"osv:CGA-82hh-mpjm-p665","products":[{"name":{"value":"knative-kafka-broker-1.22-dispatcher-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.3-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-82hh-mpjm-p665","aliases":["CGA-82hh-mpjm-p665"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r18"}]}],"package":{"name":"knative-kafka-broker-1.22-dispatcher-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-1.22-dispatcher-loom?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-82hh-mpjm-p665.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/app/libs/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T23:00:47Z"}]}}],"modified":"2026-10-03T10:32:36.029812161Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:751092c6-0a2c-45b6-9406-2d436bc5cebd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-82hh-mpjm-p665","advisory_id":"751092c6-0a2c-45b6-9406-2d436bc5cebd","event_types":["advisory"],"published_at":"2026-10-26T01:07:14.833788+00:00","technologies":["core-osv","knative-kafka-broker-1-22-dispatcher-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:49:26+00:00","detail_url":"/advisories/advisory%3A751092c6-0a2c-45b6-9406-2d436bc5cebd","group":{"id":"advisory:751092c6-0a2c-45b6-9406-2d436bc5cebd","revision":1,"primary_event_id":73614,"change":"published","superseded_by":[],"changed":{"id":73614,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-82hh-mpjm-p665","summary":"CGA-82hh-mpjm-p665","evidence":"osv:CGA-82hh-mpjm-p665","products":[{"name":{"value":"knative-kafka-broker-1.22-dispatcher-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.3-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-82hh-mpjm-p665","aliases":["CGA-82hh-mpjm-p665"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r18"}]}],"package":{"name":"knative-kafka-broker-1.22-dispatcher-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-1.22-dispatcher-loom?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-82hh-mpjm-p665.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/app/libs/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T23:00:47Z"}]}}],"modified":"2026-10-03T10:32:36.029812161Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:751092c6-0a2c-45b6-9406-2d436bc5cebd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-82hh-mpjm-p665","advisory_id":"751092c6-0a2c-45b6-9406-2d436bc5cebd","event_types":["advisory"],"published_at":"2026-10-26T01:07:14.833788+00:00","technologies":["core-osv","knative-kafka-broker-1-22-dispatcher-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:49:26+00:00","detail_url":"/events/73614"},"members":[{"id":73614,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-82hh-mpjm-p665","summary":"CGA-82hh-mpjm-p665","evidence":"osv:CGA-82hh-mpjm-p665","products":[{"name":{"value":"knative-kafka-broker-1.22-dispatcher-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.3-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-82hh-mpjm-p665","aliases":["CGA-82hh-mpjm-p665"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r18"}]}],"package":{"name":"knative-kafka-broker-1.22-dispatcher-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-1.22-dispatcher-loom?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-82hh-mpjm-p665.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/app/libs/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T23:00:47Z"}]}}],"modified":"2026-10-03T10:32:36.029812161Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:751092c6-0a2c-45b6-9406-2d436bc5cebd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-82hh-mpjm-p665","advisory_id":"751092c6-0a2c-45b6-9406-2d436bc5cebd","event_types":["advisory"],"published_at":"2026-10-26T01:07:14.833788+00:00","technologies":["core-osv","knative-kafka-broker-1-22-dispatcher-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:49:26+00:00","detail_url":"/events/73614"}]}}],"next_after":72933,"next_before":72791}