{"schema_version":"2","view":"grouped","data":[{"id":72945,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-9qcj-qcm8-j4rm","summary":"CGA-9qcj-qcm8-j4rm","evidence":"osv:CGA-9qcj-qcm8-j4rm","products":[{"name":{"value":"opensearch-fips-3-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9qcj-qcm8-j4rm","aliases":["CGA-9qcj-qcm8-j4rm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-fips-3-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9qcj-qcm8-j4rm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:33:34Z"}]}}],"modified":"2026-10-03T10:32:37.044209996Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e2d8399f-42bb-4adc-9088-6b4a6c6bfa02","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9qcj-qcm8-j4rm","advisory_id":"e2d8399f-42bb-4adc-9088-6b4a6c6bfa02","event_types":["advisory"],"published_at":"2026-10-26T01:43:02.875753+00:00","technologies":["core-osv","opensearch-fips-3-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:40:01+00:00","detail_url":"/advisories/advisory%3Ae2d8399f-42bb-4adc-9088-6b4a6c6bfa02","group":{"id":"advisory:e2d8399f-42bb-4adc-9088-6b4a6c6bfa02","revision":1,"primary_event_id":74021,"change":"published","superseded_by":[],"changed":{"id":74021,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-9qcj-qcm8-j4rm","summary":"CGA-9qcj-qcm8-j4rm","evidence":"osv:CGA-9qcj-qcm8-j4rm","products":[{"name":{"value":"opensearch-fips-3-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9qcj-qcm8-j4rm","aliases":["CGA-9qcj-qcm8-j4rm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-fips-3-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9qcj-qcm8-j4rm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:33:34Z"}]}}],"modified":"2026-10-03T10:32:37.044209996Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e2d8399f-42bb-4adc-9088-6b4a6c6bfa02","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9qcj-qcm8-j4rm","advisory_id":"e2d8399f-42bb-4adc-9088-6b4a6c6bfa02","event_types":["advisory"],"published_at":"2026-10-26T01:43:02.875753+00:00","technologies":["core-osv","opensearch-fips-3-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:40:01+00:00","detail_url":"/events/74021"},"members":[{"id":74021,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-9qcj-qcm8-j4rm","summary":"CGA-9qcj-qcm8-j4rm","evidence":"osv:CGA-9qcj-qcm8-j4rm","products":[{"name":{"value":"opensearch-fips-3-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9qcj-qcm8-j4rm","aliases":["CGA-9qcj-qcm8-j4rm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-fips-3-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9qcj-qcm8-j4rm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:33:34Z"}]}}],"modified":"2026-10-03T10:32:37.044209996Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e2d8399f-42bb-4adc-9088-6b4a6c6bfa02","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9qcj-qcm8-j4rm","advisory_id":"e2d8399f-42bb-4adc-9088-6b4a6c6bfa02","event_types":["advisory"],"published_at":"2026-10-26T01:43:02.875753+00:00","technologies":["core-osv","opensearch-fips-3-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:40:01+00:00","detail_url":"/events/74021"}]}},{"id":72907,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-f5x8-6g98-7ppg","summary":"CGA-f5x8-6g98-7ppg","evidence":"osv:CGA-f5x8-6g98-7ppg","products":[{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f5x8-6g98-7ppg","aliases":["CGA-f5x8-6g98-7ppg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/chainguard/opensearch-3-repository-azure?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f5x8-6g98-7ppg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:30:15Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/wolfi/opensearch-3-repository-azure?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f5x8-6g98-7ppg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:30:15Z"}]}}],"modified":"2026-10-03T10:32:39.767637870Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b2ce96d1-48f5-4a56-bd43-02463ecda45a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f5x8-6g98-7ppg","advisory_id":"b2ce96d1-48f5-4a56-bd43-02463ecda45a","event_types":["advisory"],"published_at":"2026-10-26T01:34:05.165207+00:00","technologies":["core-osv","opensearch-3-repository-azure"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:31:09+00:00","detail_url":"/advisories/advisory%3Ab2ce96d1-48f5-4a56-bd43-02463ecda45a","group":{"id":"advisory:b2ce96d1-48f5-4a56-bd43-02463ecda45a","revision":1,"primary_event_id":73917,"change":"published","superseded_by":[],"changed":{"id":73917,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-f5x8-6g98-7ppg","summary":"CGA-f5x8-6g98-7ppg","evidence":"osv:CGA-f5x8-6g98-7ppg","products":[{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f5x8-6g98-7ppg","aliases":["CGA-f5x8-6g98-7ppg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/chainguard/opensearch-3-repository-azure?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f5x8-6g98-7ppg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:30:15Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/wolfi/opensearch-3-repository-azure?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f5x8-6g98-7ppg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:30:15Z"}]}}],"modified":"2026-10-03T10:32:39.767637870Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b2ce96d1-48f5-4a56-bd43-02463ecda45a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f5x8-6g98-7ppg","advisory_id":"b2ce96d1-48f5-4a56-bd43-02463ecda45a","event_types":["advisory"],"published_at":"2026-10-26T01:34:05.165207+00:00","technologies":["core-osv","opensearch-3-repository-azure"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:31:09+00:00","detail_url":"/events/73917"},"members":[{"id":73917,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-f5x8-6g98-7ppg","summary":"CGA-f5x8-6g98-7ppg","evidence":"osv:CGA-f5x8-6g98-7ppg","products":[{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-azure","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f5x8-6g98-7ppg","aliases":["CGA-f5x8-6g98-7ppg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/chainguard/opensearch-3-repository-azure?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f5x8-6g98-7ppg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:30:15Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-azure","purl":"pkg:apk/wolfi/opensearch-3-repository-azure?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f5x8-6g98-7ppg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-azure/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:30:15Z"}]}}],"modified":"2026-10-03T10:32:39.767637870Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b2ce96d1-48f5-4a56-bd43-02463ecda45a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f5x8-6g98-7ppg","advisory_id":"b2ce96d1-48f5-4a56-bd43-02463ecda45a","event_types":["advisory"],"published_at":"2026-10-26T01:34:05.165207+00:00","technologies":["core-osv","opensearch-3-repository-azure"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:31:09+00:00","detail_url":"/events/73917"}]}},{"id":72885,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-9rhp-q939-jc6w","summary":"CGA-9rhp-q939-jc6w","evidence":"osv:CGA-9rhp-q939-jc6w","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9rhp-q939-jc6w","aliases":["CGA-9rhp-q939-jc6w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rhp-q939-jc6w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:06:47Z"}]}}],"modified":"2026-10-03T10:32:38.295054542Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e6e052aa-6ed8-4305-b660-7283f29b709c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9rhp-q939-jc6w","advisory_id":"e6e052aa-6ed8-4305-b660-7283f29b709c","event_types":["advisory"],"published_at":"2026-10-26T01:26:16.403814+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:14:03+00:00","detail_url":"/advisories/advisory%3Ae6e052aa-6ed8-4305-b660-7283f29b709c","group":{"id":"advisory:e6e052aa-6ed8-4305-b660-7283f29b709c","revision":1,"primary_event_id":73832,"change":"published","superseded_by":[],"changed":{"id":73832,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-9rhp-q939-jc6w","summary":"CGA-9rhp-q939-jc6w","evidence":"osv:CGA-9rhp-q939-jc6w","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9rhp-q939-jc6w","aliases":["CGA-9rhp-q939-jc6w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rhp-q939-jc6w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:06:47Z"}]}}],"modified":"2026-10-03T10:32:38.295054542Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e6e052aa-6ed8-4305-b660-7283f29b709c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9rhp-q939-jc6w","advisory_id":"e6e052aa-6ed8-4305-b660-7283f29b709c","event_types":["advisory"],"published_at":"2026-10-26T01:26:16.403814+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:14:03+00:00","detail_url":"/events/73832"},"members":[{"id":73832,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-9rhp-q939-jc6w","summary":"CGA-9rhp-q939-jc6w","evidence":"osv:CGA-9rhp-q939-jc6w","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9rhp-q939-jc6w","aliases":["CGA-9rhp-q939-jc6w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rhp-q939-jc6w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:06:47Z"}]}}],"modified":"2026-10-03T10:32:38.295054542Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e6e052aa-6ed8-4305-b660-7283f29b709c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9rhp-q939-jc6w","advisory_id":"e6e052aa-6ed8-4305-b660-7283f29b709c","event_types":["advisory"],"published_at":"2026-10-26T01:26:16.403814+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:14:03+00:00","detail_url":"/events/73832"}]}},{"id":72883,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-9vw6-wmg9-cwvj","summary":"CGA-9vw6-wmg9-cwvj","evidence":"osv:CGA-9vw6-wmg9-cwvj","products":[{"name":{"value":"opensearch-fips-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9vw6-wmg9-cwvj","aliases":["CGA-9vw6-wmg9-cwvj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-fips-3-repository-s3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9vw6-wmg9-cwvj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:09:08Z"}]}}],"modified":"2026-10-03T10:32:37.901577632Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3e680152-02e5-4e38-9e85-a70b40ea66bf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9vw6-wmg9-cwvj","advisory_id":"3e680152-02e5-4e38-9e85-a70b40ea66bf","event_types":["advisory"],"published_at":"2026-10-26T01:25:49.236458+00:00","technologies":["core-osv","opensearch-fips-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:18:09+00:00","detail_url":"/advisories/advisory%3A3e680152-02e5-4e38-9e85-a70b40ea66bf","group":{"id":"advisory:3e680152-02e5-4e38-9e85-a70b40ea66bf","revision":1,"primary_event_id":73829,"change":"published","superseded_by":[],"changed":{"id":73829,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-9vw6-wmg9-cwvj","summary":"CGA-9vw6-wmg9-cwvj","evidence":"osv:CGA-9vw6-wmg9-cwvj","products":[{"name":{"value":"opensearch-fips-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9vw6-wmg9-cwvj","aliases":["CGA-9vw6-wmg9-cwvj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-fips-3-repository-s3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9vw6-wmg9-cwvj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:09:08Z"}]}}],"modified":"2026-10-03T10:32:37.901577632Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3e680152-02e5-4e38-9e85-a70b40ea66bf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9vw6-wmg9-cwvj","advisory_id":"3e680152-02e5-4e38-9e85-a70b40ea66bf","event_types":["advisory"],"published_at":"2026-10-26T01:25:49.236458+00:00","technologies":["core-osv","opensearch-fips-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:18:09+00:00","detail_url":"/events/73829"},"members":[{"id":73829,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-9vw6-wmg9-cwvj","summary":"CGA-9vw6-wmg9-cwvj","evidence":"osv:CGA-9vw6-wmg9-cwvj","products":[{"name":{"value":"opensearch-fips-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9vw6-wmg9-cwvj","aliases":["CGA-9vw6-wmg9-cwvj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-fips-3-repository-s3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9vw6-wmg9-cwvj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:09:08Z"}]}}],"modified":"2026-10-03T10:32:37.901577632Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3e680152-02e5-4e38-9e85-a70b40ea66bf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9vw6-wmg9-cwvj","advisory_id":"3e680152-02e5-4e38-9e85-a70b40ea66bf","event_types":["advisory"],"published_at":"2026-10-26T01:25:49.236458+00:00","technologies":["core-osv","opensearch-fips-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:18:09+00:00","detail_url":"/events/73829"}]}},{"id":72866,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-53rc-hx9j-9grq","summary":"CGA-53rc-hx9j-9grq","evidence":"osv:CGA-53rc-hx9j-9grq","products":[{"name":{"value":"opensearch-3-anomaly-detection","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-anomaly-detection","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-53rc-hx9j-9grq","aliases":["CGA-53rc-hx9j-9grq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-anomaly-detection","purl":"pkg:apk/chainguard/opensearch-3-anomaly-detection?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-53rc-hx9j-9grq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:03:49Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-anomaly-detection","purl":"pkg:apk/wolfi/opensearch-3-anomaly-detection?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-53rc-hx9j-9grq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:03:49Z"}]}}],"modified":"2026-10-03T10:32:27.979841724Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:97e6fad0-34e4-41ad-ad5e-a0e2442b85a7","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-53rc-hx9j-9grq","advisory_id":"97e6fad0-34e4-41ad-ad5e-a0e2442b85a7","event_types":["advisory"],"published_at":"2026-10-26T01:20:17.880447+00:00","technologies":["core-osv","opensearch-3-anomaly-detection"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:30:19+00:00","detail_url":"/advisories/advisory%3A97e6fad0-34e4-41ad-ad5e-a0e2442b85a7","group":{"id":"advisory:97e6fad0-34e4-41ad-ad5e-a0e2442b85a7","revision":1,"primary_event_id":73754,"change":"published","superseded_by":[],"changed":{"id":73754,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-53rc-hx9j-9grq","summary":"CGA-53rc-hx9j-9grq","evidence":"osv:CGA-53rc-hx9j-9grq","products":[{"name":{"value":"opensearch-3-anomaly-detection","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-anomaly-detection","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-53rc-hx9j-9grq","aliases":["CGA-53rc-hx9j-9grq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-anomaly-detection","purl":"pkg:apk/chainguard/opensearch-3-anomaly-detection?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-53rc-hx9j-9grq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:03:49Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-anomaly-detection","purl":"pkg:apk/wolfi/opensearch-3-anomaly-detection?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-53rc-hx9j-9grq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:03:49Z"}]}}],"modified":"2026-10-03T10:32:27.979841724Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:97e6fad0-34e4-41ad-ad5e-a0e2442b85a7","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-53rc-hx9j-9grq","advisory_id":"97e6fad0-34e4-41ad-ad5e-a0e2442b85a7","event_types":["advisory"],"published_at":"2026-10-26T01:20:17.880447+00:00","technologies":["core-osv","opensearch-3-anomaly-detection"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:30:19+00:00","detail_url":"/events/73754"},"members":[{"id":73754,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-53rc-hx9j-9grq","summary":"CGA-53rc-hx9j-9grq","evidence":"osv:CGA-53rc-hx9j-9grq","products":[{"name":{"value":"opensearch-3-anomaly-detection","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-anomaly-detection","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-53rc-hx9j-9grq","aliases":["CGA-53rc-hx9j-9grq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-anomaly-detection","purl":"pkg:apk/chainguard/opensearch-3-anomaly-detection?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-53rc-hx9j-9grq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:03:49Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-anomaly-detection","purl":"pkg:apk/wolfi/opensearch-3-anomaly-detection?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-53rc-hx9j-9grq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:03:49Z"}]}}],"modified":"2026-10-03T10:32:27.979841724Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:97e6fad0-34e4-41ad-ad5e-a0e2442b85a7","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-53rc-hx9j-9grq","advisory_id":"97e6fad0-34e4-41ad-ad5e-a0e2442b85a7","event_types":["advisory"],"published_at":"2026-10-26T01:20:17.880447+00:00","technologies":["core-osv","opensearch-3-anomaly-detection"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:30:19+00:00","detail_url":"/events/73754"}]}},{"id":72837,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-73m3-79xj-r6r5","summary":"CGA-73m3-79xj-r6r5","evidence":"osv:CGA-73m3-79xj-r6r5","products":[{"name":{"value":"kayenta-fips-2026.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-73m3-79xj-r6r5","aliases":["CGA-73m3-79xj-r6r5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"kayenta-fips-2026.0","purl":"pkg:apk/chainguard/kayenta-fips-2026.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-73m3-79xj-r6r5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.2","component_type":"java-archive","component_version":"2.18.2","component_location":"/opt/kayenta/lib/signalfx-java-1.0.49.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T02:11:16Z"}]}}],"modified":"2026-10-03T10:32:34.950962187Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:724e7d0d-8e83-4b10-b197-bbb798ce7aaf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-73m3-79xj-r6r5","advisory_id":"724e7d0d-8e83-4b10-b197-bbb798ce7aaf","event_types":["advisory"],"published_at":"2026-10-26T01:14:11.305989+00:00","technologies":["core-osv","kayenta-fips-2026-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:46:33+00:00","detail_url":"/advisories/advisory%3A724e7d0d-8e83-4b10-b197-bbb798ce7aaf","group":{"id":"advisory:724e7d0d-8e83-4b10-b197-bbb798ce7aaf","revision":1,"primary_event_id":73690,"change":"published","superseded_by":[],"changed":{"id":73690,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-73m3-79xj-r6r5","summary":"CGA-73m3-79xj-r6r5","evidence":"osv:CGA-73m3-79xj-r6r5","products":[{"name":{"value":"kayenta-fips-2026.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-73m3-79xj-r6r5","aliases":["CGA-73m3-79xj-r6r5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"kayenta-fips-2026.0","purl":"pkg:apk/chainguard/kayenta-fips-2026.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-73m3-79xj-r6r5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.2","component_type":"java-archive","component_version":"2.18.2","component_location":"/opt/kayenta/lib/signalfx-java-1.0.49.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T02:11:16Z"}]}}],"modified":"2026-10-03T10:32:34.950962187Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:724e7d0d-8e83-4b10-b197-bbb798ce7aaf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-73m3-79xj-r6r5","advisory_id":"724e7d0d-8e83-4b10-b197-bbb798ce7aaf","event_types":["advisory"],"published_at":"2026-10-26T01:14:11.305989+00:00","technologies":["core-osv","kayenta-fips-2026-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:46:33+00:00","detail_url":"/events/73690"},"members":[{"id":73690,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-73m3-79xj-r6r5","summary":"CGA-73m3-79xj-r6r5","evidence":"osv:CGA-73m3-79xj-r6r5","products":[{"name":{"value":"kayenta-fips-2026.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-73m3-79xj-r6r5","aliases":["CGA-73m3-79xj-r6r5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"kayenta-fips-2026.0","purl":"pkg:apk/chainguard/kayenta-fips-2026.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-73m3-79xj-r6r5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.2","component_type":"java-archive","component_version":"2.18.2","component_location":"/opt/kayenta/lib/signalfx-java-1.0.49.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T02:11:16Z"}]}}],"modified":"2026-10-03T10:32:34.950962187Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:724e7d0d-8e83-4b10-b197-bbb798ce7aaf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-73m3-79xj-r6r5","advisory_id":"724e7d0d-8e83-4b10-b197-bbb798ce7aaf","event_types":["advisory"],"published_at":"2026-10-26T01:14:11.305989+00:00","technologies":["core-osv","kayenta-fips-2026-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:46:33+00:00","detail_url":"/events/73690"}]}},{"id":72818,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-88rc-8778-v6px","summary":"CGA-88rc-8778-v6px","evidence":"osv:CGA-88rc-8778-v6px","products":[{"name":{"value":"opensearch-fips-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-88rc-8778-v6px","aliases":["CGA-88rc-8778-v6px"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3","purl":"pkg:apk/chainguard/opensearch-fips-3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-88rc-8778-v6px.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:44:10Z"}]}}],"modified":"2026-10-03T10:32:36.539335273Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:043f1400-9d30-4f1e-96a5-8da25543789c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-88rc-8778-v6px","advisory_id":"043f1400-9d30-4f1e-96a5-8da25543789c","event_types":["advisory"],"published_at":"2026-10-26T01:11:17.831115+00:00","technologies":["core-osv","opensearch-fips-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:58:28+00:00","detail_url":"/advisories/advisory%3A043f1400-9d30-4f1e-96a5-8da25543789c","group":{"id":"advisory:043f1400-9d30-4f1e-96a5-8da25543789c","revision":1,"primary_event_id":73658,"change":"published","superseded_by":[],"changed":{"id":73658,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-88rc-8778-v6px","summary":"CGA-88rc-8778-v6px","evidence":"osv:CGA-88rc-8778-v6px","products":[{"name":{"value":"opensearch-fips-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-88rc-8778-v6px","aliases":["CGA-88rc-8778-v6px"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3","purl":"pkg:apk/chainguard/opensearch-fips-3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-88rc-8778-v6px.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:44:10Z"}]}}],"modified":"2026-10-03T10:32:36.539335273Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:043f1400-9d30-4f1e-96a5-8da25543789c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-88rc-8778-v6px","advisory_id":"043f1400-9d30-4f1e-96a5-8da25543789c","event_types":["advisory"],"published_at":"2026-10-26T01:11:17.831115+00:00","technologies":["core-osv","opensearch-fips-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:58:28+00:00","detail_url":"/events/73658"},"members":[{"id":73658,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-88rc-8778-v6px","summary":"CGA-88rc-8778-v6px","evidence":"osv:CGA-88rc-8778-v6px","products":[{"name":{"value":"opensearch-fips-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-88rc-8778-v6px","aliases":["CGA-88rc-8778-v6px"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3","purl":"pkg:apk/chainguard/opensearch-fips-3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-88rc-8778-v6px.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:44:10Z"}]}}],"modified":"2026-10-03T10:32:36.539335273Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:043f1400-9d30-4f1e-96a5-8da25543789c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-88rc-8778-v6px","advisory_id":"043f1400-9d30-4f1e-96a5-8da25543789c","event_types":["advisory"],"published_at":"2026-10-26T01:11:17.831115+00:00","technologies":["core-osv","opensearch-fips-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:58:28+00:00","detail_url":"/events/73658"}]}},{"id":72807,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-7j69-jm5c-p874","summary":"CGA-7j69-jm5c-p874","evidence":"osv:CGA-7j69-jm5c-p874","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7j69-jm5c-p874","aliases":["CGA-7j69-jm5c-p874"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7j69-jm5c-p874.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:49:50Z"}]}}],"modified":"2026-10-03T10:32:35.321301719Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f619626-2232-4ca9-8f85-68216c202bd8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7j69-jm5c-p874","advisory_id":"6f619626-2232-4ca9-8f85-68216c202bd8","event_types":["advisory"],"published_at":"2026-10-26T01:09:04.187636+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:18:43+00:00","detail_url":"/advisories/advisory%3A6f619626-2232-4ca9-8f85-68216c202bd8","group":{"id":"advisory:6f619626-2232-4ca9-8f85-68216c202bd8","revision":1,"primary_event_id":73639,"change":"published","superseded_by":[],"changed":{"id":73639,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-7j69-jm5c-p874","summary":"CGA-7j69-jm5c-p874","evidence":"osv:CGA-7j69-jm5c-p874","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7j69-jm5c-p874","aliases":["CGA-7j69-jm5c-p874"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7j69-jm5c-p874.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:49:50Z"}]}}],"modified":"2026-10-03T10:32:35.321301719Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f619626-2232-4ca9-8f85-68216c202bd8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7j69-jm5c-p874","advisory_id":"6f619626-2232-4ca9-8f85-68216c202bd8","event_types":["advisory"],"published_at":"2026-10-26T01:09:04.187636+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:18:43+00:00","detail_url":"/events/73639"},"members":[{"id":73639,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-7j69-jm5c-p874","summary":"CGA-7j69-jm5c-p874","evidence":"osv:CGA-7j69-jm5c-p874","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7j69-jm5c-p874","aliases":["CGA-7j69-jm5c-p874"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7j69-jm5c-p874.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:49:50Z"}]}}],"modified":"2026-10-03T10:32:35.321301719Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f619626-2232-4ca9-8f85-68216c202bd8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7j69-jm5c-p874","advisory_id":"6f619626-2232-4ca9-8f85-68216c202bd8","event_types":["advisory"],"published_at":"2026-10-26T01:09:04.187636+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:18:43+00:00","detail_url":"/events/73639"}]}},{"id":72806,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-66xx-8296-x55w","summary":"CGA-66xx-8296-x55w","evidence":"osv:CGA-66xx-8296-x55w","products":[{"name":{"value":"opensearch-3-discovery-ec2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-discovery-ec2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-66xx-8296-x55w","aliases":["CGA-66xx-8296-x55w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-ec2","purl":"pkg:apk/chainguard/opensearch-3-discovery-ec2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-66xx-8296-x55w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:33:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-ec2","purl":"pkg:apk/wolfi/opensearch-3-discovery-ec2?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-66xx-8296-x55w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:33:08Z"}]}}],"modified":"2026-10-03T10:32:32.106186950Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:52271af6-e3e6-4a38-a405-8609574d07fc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-66xx-8296-x55w","advisory_id":"52271af6-e3e6-4a38-a405-8609574d07fc","event_types":["advisory"],"published_at":"2026-10-26T01:08:46.084722+00:00","technologies":["core-osv","opensearch-3-discovery-ec2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:10:34+00:00","detail_url":"/advisories/advisory%3A52271af6-e3e6-4a38-a405-8609574d07fc","group":{"id":"advisory:52271af6-e3e6-4a38-a405-8609574d07fc","revision":1,"primary_event_id":73635,"change":"published","superseded_by":[],"changed":{"id":73635,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-66xx-8296-x55w","summary":"CGA-66xx-8296-x55w","evidence":"osv:CGA-66xx-8296-x55w","products":[{"name":{"value":"opensearch-3-discovery-ec2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-discovery-ec2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-66xx-8296-x55w","aliases":["CGA-66xx-8296-x55w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-ec2","purl":"pkg:apk/chainguard/opensearch-3-discovery-ec2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-66xx-8296-x55w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:33:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-ec2","purl":"pkg:apk/wolfi/opensearch-3-discovery-ec2?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-66xx-8296-x55w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:33:08Z"}]}}],"modified":"2026-10-03T10:32:32.106186950Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:52271af6-e3e6-4a38-a405-8609574d07fc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-66xx-8296-x55w","advisory_id":"52271af6-e3e6-4a38-a405-8609574d07fc","event_types":["advisory"],"published_at":"2026-10-26T01:08:46.084722+00:00","technologies":["core-osv","opensearch-3-discovery-ec2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:10:34+00:00","detail_url":"/events/73635"},"members":[{"id":73635,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-66xx-8296-x55w","summary":"CGA-66xx-8296-x55w","evidence":"osv:CGA-66xx-8296-x55w","products":[{"name":{"value":"opensearch-3-discovery-ec2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-discovery-ec2","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-66xx-8296-x55w","aliases":["CGA-66xx-8296-x55w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-ec2","purl":"pkg:apk/chainguard/opensearch-3-discovery-ec2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-66xx-8296-x55w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:33:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-discovery-ec2","purl":"pkg:apk/wolfi/opensearch-3-discovery-ec2?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-66xx-8296-x55w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:33:08Z"}]}}],"modified":"2026-10-03T10:32:32.106186950Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:52271af6-e3e6-4a38-a405-8609574d07fc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-66xx-8296-x55w","advisory_id":"52271af6-e3e6-4a38-a405-8609574d07fc","event_types":["advisory"],"published_at":"2026-10-26T01:08:46.084722+00:00","technologies":["core-osv","opensearch-3-discovery-ec2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:10:34+00:00","detail_url":"/events/73635"}]}},{"id":72781,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-84cq-q88x-c9vp","summary":"CGA-84cq-q88x-c9vp","evidence":"osv:CGA-84cq-q88x-c9vp","products":[{"name":{"value":"opensearch-fips-3-discovery-ec2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-84cq-q88x-c9vp","aliases":["CGA-84cq-q88x-c9vp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-discovery-ec2","purl":"pkg:apk/chainguard/opensearch-fips-3-discovery-ec2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-84cq-q88x-c9vp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:44Z"}]}}],"modified":"2026-10-03T10:32:35.909440972Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a9f968e3-97ff-402e-921f-7ab9116765c8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-84cq-q88x-c9vp","advisory_id":"a9f968e3-97ff-402e-921f-7ab9116765c8","event_types":["advisory"],"published_at":"2026-10-26T01:04:14.498294+00:00","technologies":["core-osv","opensearch-fips-3-discovery-ec2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:58:07+00:00","detail_url":"/advisories/advisory%3Aa9f968e3-97ff-402e-921f-7ab9116765c8","group":{"id":"advisory:a9f968e3-97ff-402e-921f-7ab9116765c8","revision":1,"primary_event_id":73585,"change":"published","superseded_by":[],"changed":{"id":73585,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-84cq-q88x-c9vp","summary":"CGA-84cq-q88x-c9vp","evidence":"osv:CGA-84cq-q88x-c9vp","products":[{"name":{"value":"opensearch-fips-3-discovery-ec2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-84cq-q88x-c9vp","aliases":["CGA-84cq-q88x-c9vp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-discovery-ec2","purl":"pkg:apk/chainguard/opensearch-fips-3-discovery-ec2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-84cq-q88x-c9vp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:44Z"}]}}],"modified":"2026-10-03T10:32:35.909440972Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a9f968e3-97ff-402e-921f-7ab9116765c8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-84cq-q88x-c9vp","advisory_id":"a9f968e3-97ff-402e-921f-7ab9116765c8","event_types":["advisory"],"published_at":"2026-10-26T01:04:14.498294+00:00","technologies":["core-osv","opensearch-fips-3-discovery-ec2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:58:07+00:00","detail_url":"/events/73585"},"members":[{"id":73585,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-84cq-q88x-c9vp","summary":"CGA-84cq-q88x-c9vp","evidence":"osv:CGA-84cq-q88x-c9vp","products":[{"name":{"value":"opensearch-fips-3-discovery-ec2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-84cq-q88x-c9vp","aliases":["CGA-84cq-q88x-c9vp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-discovery-ec2","purl":"pkg:apk/chainguard/opensearch-fips-3-discovery-ec2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-84cq-q88x-c9vp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:44Z"}]}}],"modified":"2026-10-03T10:32:35.909440972Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a9f968e3-97ff-402e-921f-7ab9116765c8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-84cq-q88x-c9vp","advisory_id":"a9f968e3-97ff-402e-921f-7ab9116765c8","event_types":["advisory"],"published_at":"2026-10-26T01:04:14.498294+00:00","technologies":["core-osv","opensearch-fips-3-discovery-ec2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:58:07+00:00","detail_url":"/events/73585"}]}},{"id":72761,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-6q5v-9qfp-whxp","summary":"CGA-6q5v-9qfp-whxp","evidence":"osv:CGA-6q5v-9qfp-whxp","products":[{"name":{"value":"opensearch-3-alerting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-alerting","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-6q5v-9qfp-whxp","aliases":["CGA-6q5v-9qfp-whxp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/chainguard/opensearch-3-alerting?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6q5v-9qfp-whxp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:39:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/wolfi/opensearch-3-alerting?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6q5v-9qfp-whxp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:39:06Z"}]}}],"modified":"2026-10-03T10:32:34.857376422Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4f3d6203-ec9a-4d24-91e3-1eed0cae8692","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6q5v-9qfp-whxp","advisory_id":"4f3d6203-ec9a-4d24-91e3-1eed0cae8692","event_types":["advisory"],"published_at":"2026-10-26T01:01:08.630108+00:00","technologies":["core-osv","opensearch-3-alerting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:29:01+00:00","detail_url":"/advisories/advisory%3A4f3d6203-ec9a-4d24-91e3-1eed0cae8692","group":{"id":"advisory:4f3d6203-ec9a-4d24-91e3-1eed0cae8692","revision":1,"primary_event_id":73544,"change":"published","superseded_by":[],"changed":{"id":73544,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-6q5v-9qfp-whxp","summary":"CGA-6q5v-9qfp-whxp","evidence":"osv:CGA-6q5v-9qfp-whxp","products":[{"name":{"value":"opensearch-3-alerting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-alerting","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-6q5v-9qfp-whxp","aliases":["CGA-6q5v-9qfp-whxp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/chainguard/opensearch-3-alerting?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6q5v-9qfp-whxp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:39:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/wolfi/opensearch-3-alerting?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6q5v-9qfp-whxp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:39:06Z"}]}}],"modified":"2026-10-03T10:32:34.857376422Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4f3d6203-ec9a-4d24-91e3-1eed0cae8692","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6q5v-9qfp-whxp","advisory_id":"4f3d6203-ec9a-4d24-91e3-1eed0cae8692","event_types":["advisory"],"published_at":"2026-10-26T01:01:08.630108+00:00","technologies":["core-osv","opensearch-3-alerting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:29:01+00:00","detail_url":"/events/73544"},"members":[{"id":73544,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-6q5v-9qfp-whxp","summary":"CGA-6q5v-9qfp-whxp","evidence":"osv:CGA-6q5v-9qfp-whxp","products":[{"name":{"value":"opensearch-3-alerting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-alerting","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-6q5v-9qfp-whxp","aliases":["CGA-6q5v-9qfp-whxp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/chainguard/opensearch-3-alerting?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6q5v-9qfp-whxp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:39:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/wolfi/opensearch-3-alerting?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6q5v-9qfp-whxp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:39:06Z"}]}}],"modified":"2026-10-03T10:32:34.857376422Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4f3d6203-ec9a-4d24-91e3-1eed0cae8692","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6q5v-9qfp-whxp","advisory_id":"4f3d6203-ec9a-4d24-91e3-1eed0cae8692","event_types":["advisory"],"published_at":"2026-10-26T01:01:08.630108+00:00","technologies":["core-osv","opensearch-3-alerting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:29:01+00:00","detail_url":"/events/73544"}]}},{"id":72716,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-649x-prm6-97fm","summary":"CGA-649x-prm6-97fm","evidence":"osv:CGA-649x-prm6-97fm","products":[{"name":{"value":"opensearch-fips-3-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-649x-prm6-97fm","aliases":["CGA-649x-prm6-97fm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-ml-commons","purl":"pkg:apk/chainguard/opensearch-fips-3-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-649x-prm6-97fm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:15:34Z"}]}}],"modified":"2026-10-03T10:32:31.332544432Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b4606a99-9f78-4887-9724-06722034223c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-649x-prm6-97fm","advisory_id":"b4606a99-9f78-4887-9724-06722034223c","event_types":["advisory"],"published_at":"2026-10-26T00:53:15.243896+00:00","technologies":["core-osv","opensearch-fips-3-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:44:41+00:00","detail_url":"/advisories/advisory%3Ab4606a99-9f78-4887-9724-06722034223c","group":{"id":"advisory:b4606a99-9f78-4887-9724-06722034223c","revision":1,"primary_event_id":73460,"change":"published","superseded_by":[],"changed":{"id":73460,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-649x-prm6-97fm","summary":"CGA-649x-prm6-97fm","evidence":"osv:CGA-649x-prm6-97fm","products":[{"name":{"value":"opensearch-fips-3-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-649x-prm6-97fm","aliases":["CGA-649x-prm6-97fm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-ml-commons","purl":"pkg:apk/chainguard/opensearch-fips-3-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-649x-prm6-97fm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:15:34Z"}]}}],"modified":"2026-10-03T10:32:31.332544432Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b4606a99-9f78-4887-9724-06722034223c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-649x-prm6-97fm","advisory_id":"b4606a99-9f78-4887-9724-06722034223c","event_types":["advisory"],"published_at":"2026-10-26T00:53:15.243896+00:00","technologies":["core-osv","opensearch-fips-3-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:44:41+00:00","detail_url":"/events/73460"},"members":[{"id":73460,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-649x-prm6-97fm","summary":"CGA-649x-prm6-97fm","evidence":"osv:CGA-649x-prm6-97fm","products":[{"name":{"value":"opensearch-fips-3-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-649x-prm6-97fm","aliases":["CGA-649x-prm6-97fm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-ml-commons","purl":"pkg:apk/chainguard/opensearch-fips-3-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-649x-prm6-97fm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:15:34Z"}]}}],"modified":"2026-10-03T10:32:31.332544432Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b4606a99-9f78-4887-9724-06722034223c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-649x-prm6-97fm","advisory_id":"b4606a99-9f78-4887-9724-06722034223c","event_types":["advisory"],"published_at":"2026-10-26T00:53:15.243896+00:00","technologies":["core-osv","opensearch-fips-3-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:44:41+00:00","detail_url":"/events/73460"}]}},{"id":72715,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-596m-5qph-7953","summary":"CGA-596m-5qph-7953","evidence":"osv:CGA-596m-5qph-7953","products":[{"name":{"value":"opensearch-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-observability","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-596m-5qph-7953","aliases":["CGA-596m-5qph-7953"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/chainguard/opensearch-3-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-596m-5qph-7953.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:34:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/wolfi/opensearch-3-observability?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-596m-5qph-7953.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:34:07Z"}]}}],"modified":"2026-10-03T10:32:29.468199786Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c7199375-df0f-4511-bcad-0fc036ec9e6d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-596m-5qph-7953","advisory_id":"c7199375-df0f-4511-bcad-0fc036ec9e6d","event_types":["advisory"],"published_at":"2026-10-26T00:53:06.469229+00:00","technologies":["core-osv","opensearch-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:16:50+00:00","detail_url":"/advisories/advisory%3Ac7199375-df0f-4511-bcad-0fc036ec9e6d","group":{"id":"advisory:c7199375-df0f-4511-bcad-0fc036ec9e6d","revision":1,"primary_event_id":73459,"change":"published","superseded_by":[],"changed":{"id":73459,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-596m-5qph-7953","summary":"CGA-596m-5qph-7953","evidence":"osv:CGA-596m-5qph-7953","products":[{"name":{"value":"opensearch-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-observability","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-596m-5qph-7953","aliases":["CGA-596m-5qph-7953"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/chainguard/opensearch-3-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-596m-5qph-7953.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:34:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/wolfi/opensearch-3-observability?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-596m-5qph-7953.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:34:07Z"}]}}],"modified":"2026-10-03T10:32:29.468199786Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c7199375-df0f-4511-bcad-0fc036ec9e6d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-596m-5qph-7953","advisory_id":"c7199375-df0f-4511-bcad-0fc036ec9e6d","event_types":["advisory"],"published_at":"2026-10-26T00:53:06.469229+00:00","technologies":["core-osv","opensearch-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:16:50+00:00","detail_url":"/events/73459"},"members":[{"id":73459,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-596m-5qph-7953","summary":"CGA-596m-5qph-7953","evidence":"osv:CGA-596m-5qph-7953","products":[{"name":{"value":"opensearch-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-observability","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-596m-5qph-7953","aliases":["CGA-596m-5qph-7953"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/chainguard/opensearch-3-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-596m-5qph-7953.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:34:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/wolfi/opensearch-3-observability?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-596m-5qph-7953.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:34:07Z"}]}}],"modified":"2026-10-03T10:32:29.468199786Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c7199375-df0f-4511-bcad-0fc036ec9e6d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-596m-5qph-7953","advisory_id":"c7199375-df0f-4511-bcad-0fc036ec9e6d","event_types":["advisory"],"published_at":"2026-10-26T00:53:06.469229+00:00","technologies":["core-osv","opensearch-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:16:50+00:00","detail_url":"/events/73459"}]}},{"id":72714,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-5842-3q5f-f49r","summary":"CGA-5842-3q5f-f49r","evidence":"osv:CGA-5842-3q5f-f49r","products":[{"name":{"value":"opensearch-3-security","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-security","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5842-3q5f-f49r","aliases":["CGA-5842-3q5f-f49r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-security","purl":"pkg:apk/chainguard/opensearch-3-security?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5842-3q5f-f49r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-security/opensaml-3.9.0.0-all.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:23Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-security","purl":"pkg:apk/wolfi/opensearch-3-security?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5842-3q5f-f49r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-security/opensaml-3.9.0.0-all.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:23Z"}]}}],"modified":"2026-10-03T10:32:28.862440396Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f28f8e48-ec68-4d95-8c84-e88035c177b8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5842-3q5f-f49r","advisory_id":"f28f8e48-ec68-4d95-8c84-e88035c177b8","event_types":["advisory"],"published_at":"2026-10-26T00:52:14.57886+00:00","technologies":["core-osv","opensearch-3-security"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:44:59+00:00","detail_url":"/advisories/advisory%3Af28f8e48-ec68-4d95-8c84-e88035c177b8","group":{"id":"advisory:f28f8e48-ec68-4d95-8c84-e88035c177b8","revision":1,"primary_event_id":73453,"change":"published","superseded_by":[],"changed":{"id":73453,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-5842-3q5f-f49r","summary":"CGA-5842-3q5f-f49r","evidence":"osv:CGA-5842-3q5f-f49r","products":[{"name":{"value":"opensearch-3-security","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-security","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5842-3q5f-f49r","aliases":["CGA-5842-3q5f-f49r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-security","purl":"pkg:apk/chainguard/opensearch-3-security?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5842-3q5f-f49r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-security/opensaml-3.9.0.0-all.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:23Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-security","purl":"pkg:apk/wolfi/opensearch-3-security?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5842-3q5f-f49r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-security/opensaml-3.9.0.0-all.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:23Z"}]}}],"modified":"2026-10-03T10:32:28.862440396Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f28f8e48-ec68-4d95-8c84-e88035c177b8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5842-3q5f-f49r","advisory_id":"f28f8e48-ec68-4d95-8c84-e88035c177b8","event_types":["advisory"],"published_at":"2026-10-26T00:52:14.57886+00:00","technologies":["core-osv","opensearch-3-security"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:44:59+00:00","detail_url":"/events/73453"},"members":[{"id":73453,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-5842-3q5f-f49r","summary":"CGA-5842-3q5f-f49r","evidence":"osv:CGA-5842-3q5f-f49r","products":[{"name":{"value":"opensearch-3-security","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-security","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5842-3q5f-f49r","aliases":["CGA-5842-3q5f-f49r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-security","purl":"pkg:apk/chainguard/opensearch-3-security?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5842-3q5f-f49r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-security/opensaml-3.9.0.0-all.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:23Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-security","purl":"pkg:apk/wolfi/opensearch-3-security?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5842-3q5f-f49r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-security/opensaml-3.9.0.0-all.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:23Z"}]}}],"modified":"2026-10-03T10:32:28.862440396Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f28f8e48-ec68-4d95-8c84-e88035c177b8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5842-3q5f-f49r","advisory_id":"f28f8e48-ec68-4d95-8c84-e88035c177b8","event_types":["advisory"],"published_at":"2026-10-26T00:52:14.57886+00:00","technologies":["core-osv","opensearch-3-security"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:44:59+00:00","detail_url":"/events/73453"}]}},{"id":72710,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-3h6c-2jr6-4rx7","summary":"CGA-3h6c-2jr6-4rx7","evidence":"osv:CGA-3h6c-2jr6-4rx7","products":[{"name":{"value":"opensearch-3-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-crypto-kms","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3h6c-2jr6-4rx7","aliases":["CGA-3h6c-2jr6-4rx7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-crypto-kms","purl":"pkg:apk/chainguard/opensearch-3-crypto-kms?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3h6c-2jr6-4rx7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:43:45Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-crypto-kms","purl":"pkg:apk/wolfi/opensearch-3-crypto-kms?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3h6c-2jr6-4rx7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:43:45Z"}]}}],"modified":"2026-10-03T10:31:47.142197602Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:50ef9519-0e6f-4135-9ee4-723e3d9feaac","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3h6c-2jr6-4rx7","advisory_id":"50ef9519-0e6f-4135-9ee4-723e3d9feaac","event_types":["advisory"],"published_at":"2026-10-26T00:51:46.965679+00:00","technologies":["core-osv","opensearch-3-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:57:51+00:00","detail_url":"/advisories/advisory%3A50ef9519-0e6f-4135-9ee4-723e3d9feaac","group":{"id":"advisory:50ef9519-0e6f-4135-9ee4-723e3d9feaac","revision":1,"primary_event_id":73449,"change":"published","superseded_by":[],"changed":{"id":73449,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-3h6c-2jr6-4rx7","summary":"CGA-3h6c-2jr6-4rx7","evidence":"osv:CGA-3h6c-2jr6-4rx7","products":[{"name":{"value":"opensearch-3-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-crypto-kms","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3h6c-2jr6-4rx7","aliases":["CGA-3h6c-2jr6-4rx7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-crypto-kms","purl":"pkg:apk/chainguard/opensearch-3-crypto-kms?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3h6c-2jr6-4rx7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:43:45Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-crypto-kms","purl":"pkg:apk/wolfi/opensearch-3-crypto-kms?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3h6c-2jr6-4rx7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:43:45Z"}]}}],"modified":"2026-10-03T10:31:47.142197602Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:50ef9519-0e6f-4135-9ee4-723e3d9feaac","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3h6c-2jr6-4rx7","advisory_id":"50ef9519-0e6f-4135-9ee4-723e3d9feaac","event_types":["advisory"],"published_at":"2026-10-26T00:51:46.965679+00:00","technologies":["core-osv","opensearch-3-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:57:51+00:00","detail_url":"/events/73449"},"members":[{"id":73449,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-3h6c-2jr6-4rx7","summary":"CGA-3h6c-2jr6-4rx7","evidence":"osv:CGA-3h6c-2jr6-4rx7","products":[{"name":{"value":"opensearch-3-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-crypto-kms","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3h6c-2jr6-4rx7","aliases":["CGA-3h6c-2jr6-4rx7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-crypto-kms","purl":"pkg:apk/chainguard/opensearch-3-crypto-kms?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3h6c-2jr6-4rx7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:43:45Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-crypto-kms","purl":"pkg:apk/wolfi/opensearch-3-crypto-kms?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3h6c-2jr6-4rx7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:43:45Z"}]}}],"modified":"2026-10-03T10:31:47.142197602Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:50ef9519-0e6f-4135-9ee4-723e3d9feaac","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3h6c-2jr6-4rx7","advisory_id":"50ef9519-0e6f-4135-9ee4-723e3d9feaac","event_types":["advisory"],"published_at":"2026-10-26T00:51:46.965679+00:00","technologies":["core-osv","opensearch-3-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:57:51+00:00","detail_url":"/events/73449"}]}},{"id":72700,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-3fgm-v3v7-xqvj","summary":"CGA-3fgm-v3v7-xqvj","evidence":"osv:CGA-3fgm-v3v7-xqvj","products":[{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3fgm-v3v7-xqvj","aliases":["CGA-3fgm-v3v7-xqvj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3fgm-v3v7-xqvj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/wolfi/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3fgm-v3v7-xqvj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:35Z"}]}}],"modified":"2026-10-03T10:31:42.207168376Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:15121a51-653e-47e4-b39c-6df93553e69a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3fgm-v3v7-xqvj","advisory_id":"15121a51-653e-47e4-b39c-6df93553e69a","event_types":["advisory"],"published_at":"2026-10-26T00:50:10.313479+00:00","technologies":["core-osv","opensearch-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:05:09+00:00","detail_url":"/advisories/advisory%3A15121a51-653e-47e4-b39c-6df93553e69a","group":{"id":"advisory:15121a51-653e-47e4-b39c-6df93553e69a","revision":1,"primary_event_id":73433,"change":"published","superseded_by":[],"changed":{"id":73433,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-3fgm-v3v7-xqvj","summary":"CGA-3fgm-v3v7-xqvj","evidence":"osv:CGA-3fgm-v3v7-xqvj","products":[{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3fgm-v3v7-xqvj","aliases":["CGA-3fgm-v3v7-xqvj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3fgm-v3v7-xqvj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/wolfi/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3fgm-v3v7-xqvj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:35Z"}]}}],"modified":"2026-10-03T10:31:42.207168376Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:15121a51-653e-47e4-b39c-6df93553e69a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3fgm-v3v7-xqvj","advisory_id":"15121a51-653e-47e4-b39c-6df93553e69a","event_types":["advisory"],"published_at":"2026-10-26T00:50:10.313479+00:00","technologies":["core-osv","opensearch-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:05:09+00:00","detail_url":"/events/73433"},"members":[{"id":73433,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-3fgm-v3v7-xqvj","summary":"CGA-3fgm-v3v7-xqvj","evidence":"osv:CGA-3fgm-v3v7-xqvj","products":[{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3fgm-v3v7-xqvj","aliases":["CGA-3fgm-v3v7-xqvj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3fgm-v3v7-xqvj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/wolfi/opensearch-3-repository-s3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3fgm-v3v7-xqvj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:16:35Z"}]}}],"modified":"2026-10-03T10:31:42.207168376Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:15121a51-653e-47e4-b39c-6df93553e69a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3fgm-v3v7-xqvj","advisory_id":"15121a51-653e-47e4-b39c-6df93553e69a","event_types":["advisory"],"published_at":"2026-10-26T00:50:10.313479+00:00","technologies":["core-osv","opensearch-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:05:09+00:00","detail_url":"/events/73433"}]}},{"id":72693,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-pvv7-9c57-mmpj","summary":"CGA-pvv7-9c57-mmpj","evidence":"osv:CGA-pvv7-9c57-mmpj","products":[{"name":{"value":"opensearch-fips-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pvv7-9c57-mmpj","aliases":["CGA-pvv7-9c57-mmpj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-observability","purl":"pkg:apk/chainguard/opensearch-fips-3-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pvv7-9c57-mmpj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:46:13Z"}]}}],"modified":"2026-10-03T10:32:08.938503641Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3ad16e89-b848-4649-9f63-363442a0d721","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pvv7-9c57-mmpj","advisory_id":"3ad16e89-b848-4649-9f63-363442a0d721","event_types":["advisory"],"published_at":"2026-10-26T00:49:07.129396+00:00","technologies":["core-osv","opensearch-fips-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:39:53+00:00","detail_url":"/advisories/advisory%3A3ad16e89-b848-4649-9f63-363442a0d721","group":{"id":"advisory:3ad16e89-b848-4649-9f63-363442a0d721","revision":1,"primary_event_id":73421,"change":"published","superseded_by":[],"changed":{"id":73421,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-pvv7-9c57-mmpj","summary":"CGA-pvv7-9c57-mmpj","evidence":"osv:CGA-pvv7-9c57-mmpj","products":[{"name":{"value":"opensearch-fips-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pvv7-9c57-mmpj","aliases":["CGA-pvv7-9c57-mmpj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-observability","purl":"pkg:apk/chainguard/opensearch-fips-3-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pvv7-9c57-mmpj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:46:13Z"}]}}],"modified":"2026-10-03T10:32:08.938503641Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3ad16e89-b848-4649-9f63-363442a0d721","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pvv7-9c57-mmpj","advisory_id":"3ad16e89-b848-4649-9f63-363442a0d721","event_types":["advisory"],"published_at":"2026-10-26T00:49:07.129396+00:00","technologies":["core-osv","opensearch-fips-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:39:53+00:00","detail_url":"/events/73421"},"members":[{"id":73421,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-pvv7-9c57-mmpj","summary":"CGA-pvv7-9c57-mmpj","evidence":"osv:CGA-pvv7-9c57-mmpj","products":[{"name":{"value":"opensearch-fips-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pvv7-9c57-mmpj","aliases":["CGA-pvv7-9c57-mmpj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-observability","purl":"pkg:apk/chainguard/opensearch-fips-3-observability?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pvv7-9c57-mmpj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:46:13Z"}]}}],"modified":"2026-10-03T10:32:08.938503641Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3ad16e89-b848-4649-9f63-363442a0d721","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pvv7-9c57-mmpj","advisory_id":"3ad16e89-b848-4649-9f63-363442a0d721","event_types":["advisory"],"published_at":"2026-10-26T00:49:07.129396+00:00","technologies":["core-osv","opensearch-fips-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:39:53+00:00","detail_url":"/events/73421"}]}},{"id":72690,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-4hm5-fjgq-cjqr","summary":"CGA-4hm5-fjgq-cjqr","evidence":"osv:CGA-4hm5-fjgq-cjqr","products":[{"name":{"value":"celeborn-0.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"celeborn-0.6","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4hm5-fjgq-cjqr","aliases":["CGA-4hm5-fjgq-cjqr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/chainguard/celeborn-0.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4hm5-fjgq-cjqr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/wolfi/celeborn-0.6?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4hm5-fjgq-cjqr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}}],"modified":"2026-10-03T10:32:18.349981222Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2eb72114-bea7-45a6-9385-5fb298dae54f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4hm5-fjgq-cjqr","advisory_id":"2eb72114-bea7-45a6-9385-5fb298dae54f","event_types":["advisory"],"published_at":"2026-10-26T00:48:44.637064+00:00","technologies":["celeborn-0-6","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:13:25+00:00","detail_url":"/advisories/advisory%3A2eb72114-bea7-45a6-9385-5fb298dae54f","group":{"id":"advisory:2eb72114-bea7-45a6-9385-5fb298dae54f","revision":1,"primary_event_id":73418,"change":"published","superseded_by":[],"changed":{"id":73418,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-4hm5-fjgq-cjqr","summary":"CGA-4hm5-fjgq-cjqr","evidence":"osv:CGA-4hm5-fjgq-cjqr","products":[{"name":{"value":"celeborn-0.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"celeborn-0.6","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4hm5-fjgq-cjqr","aliases":["CGA-4hm5-fjgq-cjqr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/chainguard/celeborn-0.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4hm5-fjgq-cjqr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/wolfi/celeborn-0.6?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4hm5-fjgq-cjqr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}}],"modified":"2026-10-03T10:32:18.349981222Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2eb72114-bea7-45a6-9385-5fb298dae54f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4hm5-fjgq-cjqr","advisory_id":"2eb72114-bea7-45a6-9385-5fb298dae54f","event_types":["advisory"],"published_at":"2026-10-26T00:48:44.637064+00:00","technologies":["celeborn-0-6","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:13:25+00:00","detail_url":"/events/73418"},"members":[{"id":73418,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-4hm5-fjgq-cjqr","summary":"CGA-4hm5-fjgq-cjqr","evidence":"osv:CGA-4hm5-fjgq-cjqr","products":[{"name":{"value":"celeborn-0.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"celeborn-0.6","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4hm5-fjgq-cjqr","aliases":["CGA-4hm5-fjgq-cjqr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/chainguard/celeborn-0.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4hm5-fjgq-cjqr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/wolfi/celeborn-0.6?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4hm5-fjgq-cjqr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}}],"modified":"2026-10-03T10:32:18.349981222Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2eb72114-bea7-45a6-9385-5fb298dae54f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4hm5-fjgq-cjqr","advisory_id":"2eb72114-bea7-45a6-9385-5fb298dae54f","event_types":["advisory"],"published_at":"2026-10-26T00:48:44.637064+00:00","technologies":["celeborn-0-6","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:13:25+00:00","detail_url":"/events/73418"}]}},{"id":72687,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-52g3-xw74-3c87","summary":"CGA-52g3-xw74-3c87","evidence":"osv:CGA-52g3-xw74-3c87","products":[{"name":{"value":"knative-kafka-broker-1.21-receiver-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.5-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-52g3-xw74-3c87","aliases":["CGA-52g3-xw74-3c87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-r6"}]}],"package":{"name":"knative-kafka-broker-1.21-receiver-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-1.21-receiver-loom?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-52g3-xw74-3c87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/app/libs/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:22:39Z"}]}}],"modified":"2026-10-03T10:32:27.583500500Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bc249bb0-edb3-471a-a49f-66665bbd872f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-52g3-xw74-3c87","advisory_id":"bc249bb0-edb3-471a-a49f-66665bbd872f","event_types":["advisory"],"published_at":"2026-10-26T00:47:19.069031+00:00","technologies":["core-osv","knative-kafka-broker-1-21-receiver-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:06:09+00:00","detail_url":"/advisories/advisory%3Abc249bb0-edb3-471a-a49f-66665bbd872f","group":{"id":"advisory:bc249bb0-edb3-471a-a49f-66665bbd872f","revision":1,"primary_event_id":73414,"change":"published","superseded_by":[],"changed":{"id":73414,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-52g3-xw74-3c87","summary":"CGA-52g3-xw74-3c87","evidence":"osv:CGA-52g3-xw74-3c87","products":[{"name":{"value":"knative-kafka-broker-1.21-receiver-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.5-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-52g3-xw74-3c87","aliases":["CGA-52g3-xw74-3c87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-r6"}]}],"package":{"name":"knative-kafka-broker-1.21-receiver-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-1.21-receiver-loom?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-52g3-xw74-3c87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/app/libs/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:22:39Z"}]}}],"modified":"2026-10-03T10:32:27.583500500Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bc249bb0-edb3-471a-a49f-66665bbd872f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-52g3-xw74-3c87","advisory_id":"bc249bb0-edb3-471a-a49f-66665bbd872f","event_types":["advisory"],"published_at":"2026-10-26T00:47:19.069031+00:00","technologies":["core-osv","knative-kafka-broker-1-21-receiver-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:06:09+00:00","detail_url":"/events/73414"},"members":[{"id":73414,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-52g3-xw74-3c87","summary":"CGA-52g3-xw74-3c87","evidence":"osv:CGA-52g3-xw74-3c87","products":[{"name":{"value":"knative-kafka-broker-1.21-receiver-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.5-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-52g3-xw74-3c87","aliases":["CGA-52g3-xw74-3c87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-r6"}]}],"package":{"name":"knative-kafka-broker-1.21-receiver-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-1.21-receiver-loom?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-52g3-xw74-3c87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/app/libs/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:22:39Z"}]}}],"modified":"2026-10-03T10:32:27.583500500Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bc249bb0-edb3-471a-a49f-66665bbd872f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-52g3-xw74-3c87","advisory_id":"bc249bb0-edb3-471a-a49f-66665bbd872f","event_types":["advisory"],"published_at":"2026-10-26T00:47:19.069031+00:00","technologies":["core-osv","knative-kafka-broker-1-21-receiver-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:06:09+00:00","detail_url":"/events/73414"}]}},{"id":72666,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-4f5m-6978-89mh","summary":"CGA-4f5m-6978-89mh","evidence":"osv:CGA-4f5m-6978-89mh","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4f5m-6978-89mh","aliases":["CGA-4f5m-6978-89mh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4f5m-6978-89mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.2","component_type":"java-archive","component_version":"2.21.2","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-kafka-12.1.2-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.2/jackson-databind-2.21.2.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:46Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4f5m-6978-89mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.2","component_type":"java-archive","component_version":"2.21.2","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-kafka-12.1.2-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.2/jackson-databind-2.21.2.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:46Z"}]}}],"modified":"2026-10-03T10:32:15.328458576Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:241d960c-9522-4386-ab79-db9d3cbe929d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4f5m-6978-89mh","advisory_id":"241d960c-9522-4386-ab79-db9d3cbe929d","event_types":["advisory"],"published_at":"2026-10-26T00:45:18.011813+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/advisories/advisory%3A241d960c-9522-4386-ab79-db9d3cbe929d","group":{"id":"advisory:241d960c-9522-4386-ab79-db9d3cbe929d","revision":1,"primary_event_id":73388,"change":"published","superseded_by":[],"changed":{"id":73388,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-4f5m-6978-89mh","summary":"CGA-4f5m-6978-89mh","evidence":"osv:CGA-4f5m-6978-89mh","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4f5m-6978-89mh","aliases":["CGA-4f5m-6978-89mh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4f5m-6978-89mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.2","component_type":"java-archive","component_version":"2.21.2","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-kafka-12.1.2-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.2/jackson-databind-2.21.2.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:46Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4f5m-6978-89mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.2","component_type":"java-archive","component_version":"2.21.2","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-kafka-12.1.2-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.2/jackson-databind-2.21.2.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:46Z"}]}}],"modified":"2026-10-03T10:32:15.328458576Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:241d960c-9522-4386-ab79-db9d3cbe929d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4f5m-6978-89mh","advisory_id":"241d960c-9522-4386-ab79-db9d3cbe929d","event_types":["advisory"],"published_at":"2026-10-26T00:45:18.011813+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/events/73388"},"members":[{"id":73388,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-4f5m-6978-89mh","summary":"CGA-4f5m-6978-89mh","evidence":"osv:CGA-4f5m-6978-89mh","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4f5m-6978-89mh","aliases":["CGA-4f5m-6978-89mh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4f5m-6978-89mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.2","component_type":"java-archive","component_version":"2.21.2","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-kafka-12.1.2-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.2/jackson-databind-2.21.2.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:46Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4f5m-6978-89mh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.2","component_type":"java-archive","component_version":"2.21.2","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-kafka-12.1.2-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.2/jackson-databind-2.21.2.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:46Z"}]}}],"modified":"2026-10-03T10:32:15.328458576Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:241d960c-9522-4386-ab79-db9d3cbe929d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4f5m-6978-89mh","advisory_id":"241d960c-9522-4386-ab79-db9d3cbe929d","event_types":["advisory"],"published_at":"2026-10-26T00:45:18.011813+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/events/73388"}]}},{"id":72646,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-4c8m-2wmg-95pg","summary":"CGA-4c8m-2wmg-95pg","evidence":"osv:CGA-4c8m-2wmg-95pg","products":[{"name":{"value":"opensearch-fips-3-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4c8m-2wmg-95pg","aliases":["CGA-4c8m-2wmg-95pg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-crypto-kms","purl":"pkg:apk/chainguard/opensearch-fips-3-crypto-kms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4c8m-2wmg-95pg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:54:07Z"}]}}],"modified":"2026-10-03T10:32:12.245481781Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:be5385ad-c88b-46cc-94a7-4fc064f4bf2d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4c8m-2wmg-95pg","advisory_id":"be5385ad-c88b-46cc-94a7-4fc064f4bf2d","event_types":["advisory"],"published_at":"2026-10-26T00:43:02.069515+00:00","technologies":["core-osv","opensearch-fips-3-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:54:16+00:00","detail_url":"/advisories/advisory%3Abe5385ad-c88b-46cc-94a7-4fc064f4bf2d","group":{"id":"advisory:be5385ad-c88b-46cc-94a7-4fc064f4bf2d","revision":1,"primary_event_id":73364,"change":"published","superseded_by":[],"changed":{"id":73364,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-4c8m-2wmg-95pg","summary":"CGA-4c8m-2wmg-95pg","evidence":"osv:CGA-4c8m-2wmg-95pg","products":[{"name":{"value":"opensearch-fips-3-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4c8m-2wmg-95pg","aliases":["CGA-4c8m-2wmg-95pg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-crypto-kms","purl":"pkg:apk/chainguard/opensearch-fips-3-crypto-kms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4c8m-2wmg-95pg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:54:07Z"}]}}],"modified":"2026-10-03T10:32:12.245481781Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:be5385ad-c88b-46cc-94a7-4fc064f4bf2d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4c8m-2wmg-95pg","advisory_id":"be5385ad-c88b-46cc-94a7-4fc064f4bf2d","event_types":["advisory"],"published_at":"2026-10-26T00:43:02.069515+00:00","technologies":["core-osv","opensearch-fips-3-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:54:16+00:00","detail_url":"/events/73364"},"members":[{"id":73364,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-4c8m-2wmg-95pg","summary":"CGA-4c8m-2wmg-95pg","evidence":"osv:CGA-4c8m-2wmg-95pg","products":[{"name":{"value":"opensearch-fips-3-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4c8m-2wmg-95pg","aliases":["CGA-4c8m-2wmg-95pg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-crypto-kms","purl":"pkg:apk/chainguard/opensearch-fips-3-crypto-kms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4c8m-2wmg-95pg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:54:07Z"}]}}],"modified":"2026-10-03T10:32:12.245481781Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:be5385ad-c88b-46cc-94a7-4fc064f4bf2d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4c8m-2wmg-95pg","advisory_id":"be5385ad-c88b-46cc-94a7-4fc064f4bf2d","event_types":["advisory"],"published_at":"2026-10-26T00:43:02.069515+00:00","technologies":["core-osv","opensearch-fips-3-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:54:16+00:00","detail_url":"/events/73364"}]}},{"id":72627,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-43xg-2hqh-m22g","summary":"CGA-43xg-2hqh-m22g","evidence":"osv:CGA-43xg-2hqh-m22g","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-43xg-2hqh-m22g","aliases":["CGA-43xg-2hqh-m22g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-43xg-2hqh-m22g.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:42Z"}]}}],"modified":"2026-10-03T10:32:03.006868090Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:045167f1-4141-480f-82b7-d430b7815492","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-43xg-2hqh-m22g","advisory_id":"045167f1-4141-480f-82b7-d430b7815492","event_types":["advisory"],"published_at":"2026-10-26T00:40:56.802571+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:06:54+00:00","detail_url":"/advisories/advisory%3A045167f1-4141-480f-82b7-d430b7815492","group":{"id":"advisory:045167f1-4141-480f-82b7-d430b7815492","revision":1,"primary_event_id":73337,"change":"published","superseded_by":[],"changed":{"id":73337,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-43xg-2hqh-m22g","summary":"CGA-43xg-2hqh-m22g","evidence":"osv:CGA-43xg-2hqh-m22g","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-43xg-2hqh-m22g","aliases":["CGA-43xg-2hqh-m22g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-43xg-2hqh-m22g.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:42Z"}]}}],"modified":"2026-10-03T10:32:03.006868090Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:045167f1-4141-480f-82b7-d430b7815492","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-43xg-2hqh-m22g","advisory_id":"045167f1-4141-480f-82b7-d430b7815492","event_types":["advisory"],"published_at":"2026-10-26T00:40:56.802571+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:06:54+00:00","detail_url":"/events/73337"},"members":[{"id":73337,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-43xg-2hqh-m22g","summary":"CGA-43xg-2hqh-m22g","evidence":"osv:CGA-43xg-2hqh-m22g","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-43xg-2hqh-m22g","aliases":["CGA-43xg-2hqh-m22g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-43xg-2hqh-m22g.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:11:42Z"}]}}],"modified":"2026-10-03T10:32:03.006868090Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:045167f1-4141-480f-82b7-d430b7815492","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-43xg-2hqh-m22g","advisory_id":"045167f1-4141-480f-82b7-d430b7815492","event_types":["advisory"],"published_at":"2026-10-26T00:40:56.802571+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:06:54+00:00","detail_url":"/events/73337"}]}},{"id":72616,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-g3p2-7g9q-pfjh","summary":"CGA-g3p2-7g9q-pfjh","evidence":"osv:CGA-g3p2-7g9q-pfjh","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-g3p2-7g9q-pfjh","aliases":["CGA-g3p2-7g9q-pfjh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g3p2-7g9q-pfjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g3p2-7g9q-pfjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}}],"modified":"2026-10-03T10:31:32.887698241Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:68c0597d-f125-42de-b162-3f2c6b6ca2ed","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g3p2-7g9q-pfjh","advisory_id":"68c0597d-f125-42de-b162-3f2c6b6ca2ed","event_types":["advisory"],"published_at":"2026-10-26T00:39:14.553276+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/advisories/advisory%3A68c0597d-f125-42de-b162-3f2c6b6ca2ed","group":{"id":"advisory:68c0597d-f125-42de-b162-3f2c6b6ca2ed","revision":1,"primary_event_id":73314,"change":"published","superseded_by":[],"changed":{"id":73314,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-g3p2-7g9q-pfjh","summary":"CGA-g3p2-7g9q-pfjh","evidence":"osv:CGA-g3p2-7g9q-pfjh","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-g3p2-7g9q-pfjh","aliases":["CGA-g3p2-7g9q-pfjh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g3p2-7g9q-pfjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g3p2-7g9q-pfjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}}],"modified":"2026-10-03T10:31:32.887698241Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:68c0597d-f125-42de-b162-3f2c6b6ca2ed","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g3p2-7g9q-pfjh","advisory_id":"68c0597d-f125-42de-b162-3f2c6b6ca2ed","event_types":["advisory"],"published_at":"2026-10-26T00:39:14.553276+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/events/73314"},"members":[{"id":73314,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-g3p2-7g9q-pfjh","summary":"CGA-g3p2-7g9q-pfjh","evidence":"osv:CGA-g3p2-7g9q-pfjh","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-g3p2-7g9q-pfjh","aliases":["CGA-g3p2-7g9q-pfjh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g3p2-7g9q-pfjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g3p2-7g9q-pfjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}}],"modified":"2026-10-03T10:31:32.887698241Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:68c0597d-f125-42de-b162-3f2c6b6ca2ed","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g3p2-7g9q-pfjh","advisory_id":"68c0597d-f125-42de-b162-3f2c6b6ca2ed","event_types":["advisory"],"published_at":"2026-10-26T00:39:14.553276+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/events/73314"}]}},{"id":72614,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-w6q7-8f33-5x9v","summary":"CGA-w6q7-8f33-5x9v","evidence":"osv:CGA-w6q7-8f33-5x9v","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-w6q7-8f33-5x9v","aliases":["CGA-w6q7-8f33-5x9v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q7-8f33-5x9v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:47:12Z"}]}}],"modified":"2026-10-02T23:01:50.163980609Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0defdeb0-af5d-447c-b8ae-287112dc6387","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q7-8f33-5x9v","advisory_id":"0defdeb0-af5d-447c-b8ae-287112dc6387","event_types":["advisory"],"published_at":"2026-10-26T00:38:48.378236+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:05:09+00:00","detail_url":"/advisories/advisory%3A0defdeb0-af5d-447c-b8ae-287112dc6387","group":{"id":"advisory:0defdeb0-af5d-447c-b8ae-287112dc6387","revision":1,"primary_event_id":73311,"change":"published","superseded_by":[],"changed":{"id":73311,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-w6q7-8f33-5x9v","summary":"CGA-w6q7-8f33-5x9v","evidence":"osv:CGA-w6q7-8f33-5x9v","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-w6q7-8f33-5x9v","aliases":["CGA-w6q7-8f33-5x9v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q7-8f33-5x9v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:47:12Z"}]}}],"modified":"2026-10-02T23:01:50.163980609Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0defdeb0-af5d-447c-b8ae-287112dc6387","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q7-8f33-5x9v","advisory_id":"0defdeb0-af5d-447c-b8ae-287112dc6387","event_types":["advisory"],"published_at":"2026-10-26T00:38:48.378236+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:05:09+00:00","detail_url":"/events/73311"},"members":[{"id":73311,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-w6q7-8f33-5x9v","summary":"CGA-w6q7-8f33-5x9v","evidence":"osv:CGA-w6q7-8f33-5x9v","products":[{"name":{"value":"logstash-fips-9.4-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-w6q7-8f33-5x9v","aliases":["CGA-w6q7-8f33-5x9v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-fips-9.4-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q7-8f33-5x9v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:47:12Z"}]}}],"modified":"2026-10-02T23:01:50.163980609Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0defdeb0-af5d-447c-b8ae-287112dc6387","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q7-8f33-5x9v","advisory_id":"0defdeb0-af5d-447c-b8ae-287112dc6387","event_types":["advisory"],"published_at":"2026-10-26T00:38:48.378236+00:00","technologies":["core-osv","logstash-fips-9-4-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:05:09+00:00","detail_url":"/events/73311"}]}},{"id":72582,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-wrwx-f4jm-cjhv","summary":"CGA-wrwx-f4jm-cjhv","evidence":"osv:CGA-wrwx-f4jm-cjhv","products":[{"name":{"value":"opensearch-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wrwx-f4jm-cjhv","aliases":["CGA-wrwx-f4jm-cjhv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3","purl":"pkg:apk/chainguard/opensearch-3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrwx-f4jm-cjhv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:55:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3","purl":"pkg:apk/wolfi/opensearch-3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrwx-f4jm-cjhv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:55:08Z"}]}}],"modified":"2026-10-03T10:31:39.102813934Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:09f5b7bd-fa8a-4c52-8f3f-a5c7ac6b7889","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrwx-f4jm-cjhv","advisory_id":"09f5b7bd-fa8a-4c52-8f3f-a5c7ac6b7889","event_types":["advisory"],"published_at":"2026-10-26T00:34:25.403839+00:00","technologies":["core-osv","opensearch-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:17:00+00:00","detail_url":"/advisories/advisory%3A09f5b7bd-fa8a-4c52-8f3f-a5c7ac6b7889","group":{"id":"advisory:09f5b7bd-fa8a-4c52-8f3f-a5c7ac6b7889","revision":1,"primary_event_id":73261,"change":"published","superseded_by":[],"changed":{"id":73261,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-wrwx-f4jm-cjhv","summary":"CGA-wrwx-f4jm-cjhv","evidence":"osv:CGA-wrwx-f4jm-cjhv","products":[{"name":{"value":"opensearch-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wrwx-f4jm-cjhv","aliases":["CGA-wrwx-f4jm-cjhv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3","purl":"pkg:apk/chainguard/opensearch-3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrwx-f4jm-cjhv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:55:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3","purl":"pkg:apk/wolfi/opensearch-3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrwx-f4jm-cjhv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:55:08Z"}]}}],"modified":"2026-10-03T10:31:39.102813934Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:09f5b7bd-fa8a-4c52-8f3f-a5c7ac6b7889","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrwx-f4jm-cjhv","advisory_id":"09f5b7bd-fa8a-4c52-8f3f-a5c7ac6b7889","event_types":["advisory"],"published_at":"2026-10-26T00:34:25.403839+00:00","technologies":["core-osv","opensearch-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:17:00+00:00","detail_url":"/events/73261"},"members":[{"id":73261,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-wrwx-f4jm-cjhv","summary":"CGA-wrwx-f4jm-cjhv","evidence":"osv:CGA-wrwx-f4jm-cjhv","products":[{"name":{"value":"opensearch-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wrwx-f4jm-cjhv","aliases":["CGA-wrwx-f4jm-cjhv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3","purl":"pkg:apk/chainguard/opensearch-3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrwx-f4jm-cjhv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:55:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3","purl":"pkg:apk/wolfi/opensearch-3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrwx-f4jm-cjhv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/modules/ingest-geoip/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:55:08Z"}]}}],"modified":"2026-10-03T10:31:39.102813934Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:09f5b7bd-fa8a-4c52-8f3f-a5c7ac6b7889","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrwx-f4jm-cjhv","advisory_id":"09f5b7bd-fa8a-4c52-8f3f-a5c7ac6b7889","event_types":["advisory"],"published_at":"2026-10-26T00:34:25.403839+00:00","technologies":["core-osv","opensearch-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:17:00+00:00","detail_url":"/events/73261"}]}},{"id":72575,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-232j-4r38-cfpc","summary":"CGA-232j-4r38-cfpc","evidence":"osv:CGA-232j-4r38-cfpc","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-232j-4r38-cfpc","aliases":["CGA-232j-4r38-cfpc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-232j-4r38-cfpc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:08Z"}]}}],"modified":"2026-10-03T10:30:58.736951231Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3503c92e-e45b-4909-a229-a8c91e6b9614","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-232j-4r38-cfpc","advisory_id":"3503c92e-e45b-4909-a229-a8c91e6b9614","event_types":["advisory"],"published_at":"2026-10-26T00:33:47.152881+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:53:48+00:00","detail_url":"/advisories/advisory%3A3503c92e-e45b-4909-a229-a8c91e6b9614","group":{"id":"advisory:3503c92e-e45b-4909-a229-a8c91e6b9614","revision":1,"primary_event_id":73254,"change":"published","superseded_by":[],"changed":{"id":73254,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-232j-4r38-cfpc","summary":"CGA-232j-4r38-cfpc","evidence":"osv:CGA-232j-4r38-cfpc","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-232j-4r38-cfpc","aliases":["CGA-232j-4r38-cfpc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-232j-4r38-cfpc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:08Z"}]}}],"modified":"2026-10-03T10:30:58.736951231Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3503c92e-e45b-4909-a229-a8c91e6b9614","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-232j-4r38-cfpc","advisory_id":"3503c92e-e45b-4909-a229-a8c91e6b9614","event_types":["advisory"],"published_at":"2026-10-26T00:33:47.152881+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:53:48+00:00","detail_url":"/events/73254"},"members":[{"id":73254,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-232j-4r38-cfpc","summary":"CGA-232j-4r38-cfpc","evidence":"osv:CGA-232j-4r38-cfpc","products":[{"name":{"value":"opensearch-2-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.6-r17","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-232j-4r38-cfpc","aliases":["CGA-232j-4r38-cfpc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.6-r17"}]}],"package":{"name":"opensearch-2-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-232j-4r38-cfpc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/performance-analyzer-rca/lib/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:08Z"}]}}],"modified":"2026-10-03T10:30:58.736951231Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3503c92e-e45b-4909-a229-a8c91e6b9614","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-232j-4r38-cfpc","advisory_id":"3503c92e-e45b-4909-a229-a8c91e6b9614","event_types":["advisory"],"published_at":"2026-10-26T00:33:47.152881+00:00","technologies":["core-osv","opensearch-2-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:53:48+00:00","detail_url":"/events/73254"}]}},{"id":72574,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-wmvr-mj46-qv3m","summary":"CGA-wmvr-mj46-qv3m","evidence":"osv:CGA-wmvr-mj46-qv3m","products":[{"name":{"value":"opensearch-fips-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wmvr-mj46-qv3m","aliases":["CGA-wmvr-mj46-qv3m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-observability","purl":"pkg:apk/chainguard/opensearch-fips-3-observability?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wmvr-mj46-qv3m.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:12:06Z"}]}}],"modified":"2026-10-03T10:31:38.090348481Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:dd580e5f-4b9f-4974-82a6-b2eca2585f74","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wmvr-mj46-qv3m","advisory_id":"dd580e5f-4b9f-4974-82a6-b2eca2585f74","event_types":["advisory"],"published_at":"2026-10-26T00:33:20.946189+00:00","technologies":["core-osv","opensearch-fips-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:54:38+00:00","detail_url":"/advisories/advisory%3Add580e5f-4b9f-4974-82a6-b2eca2585f74","group":{"id":"advisory:dd580e5f-4b9f-4974-82a6-b2eca2585f74","revision":1,"primary_event_id":73251,"change":"published","superseded_by":[],"changed":{"id":73251,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-wmvr-mj46-qv3m","summary":"CGA-wmvr-mj46-qv3m","evidence":"osv:CGA-wmvr-mj46-qv3m","products":[{"name":{"value":"opensearch-fips-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wmvr-mj46-qv3m","aliases":["CGA-wmvr-mj46-qv3m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-observability","purl":"pkg:apk/chainguard/opensearch-fips-3-observability?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wmvr-mj46-qv3m.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:12:06Z"}]}}],"modified":"2026-10-03T10:31:38.090348481Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:dd580e5f-4b9f-4974-82a6-b2eca2585f74","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wmvr-mj46-qv3m","advisory_id":"dd580e5f-4b9f-4974-82a6-b2eca2585f74","event_types":["advisory"],"published_at":"2026-10-26T00:33:20.946189+00:00","technologies":["core-osv","opensearch-fips-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:54:38+00:00","detail_url":"/events/73251"},"members":[{"id":73251,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-wmvr-mj46-qv3m","summary":"CGA-wmvr-mj46-qv3m","evidence":"osv:CGA-wmvr-mj46-qv3m","products":[{"name":{"value":"opensearch-fips-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wmvr-mj46-qv3m","aliases":["CGA-wmvr-mj46-qv3m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-observability","purl":"pkg:apk/chainguard/opensearch-fips-3-observability?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wmvr-mj46-qv3m.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:12:06Z"}]}}],"modified":"2026-10-03T10:31:38.090348481Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:dd580e5f-4b9f-4974-82a6-b2eca2585f74","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wmvr-mj46-qv3m","advisory_id":"dd580e5f-4b9f-4974-82a6-b2eca2585f74","event_types":["advisory"],"published_at":"2026-10-26T00:33:20.946189+00:00","technologies":["core-osv","opensearch-fips-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:54:38+00:00","detail_url":"/events/73251"}]}},{"id":72561,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-2rwc-vhgw-29v9","summary":"CGA-2rwc-vhgw-29v9","evidence":"osv:CGA-2rwc-vhgw-29v9","products":[{"name":{"value":"opensearch-fips-3-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2rwc-vhgw-29v9","aliases":["CGA-2rwc-vhgw-29v9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-sql","purl":"pkg:apk/chainguard/opensearch-fips-3-sql?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2rwc-vhgw-29v9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:17:07Z"}]}}],"modified":"2026-10-03T10:31:20.386765960Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6683c29d-345d-4943-8ca3-33f9679ba298","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2rwc-vhgw-29v9","advisory_id":"6683c29d-345d-4943-8ca3-33f9679ba298","event_types":["advisory"],"published_at":"2026-10-26T00:32:19.319252+00:00","technologies":["core-osv","opensearch-fips-3-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:22:02+00:00","detail_url":"/advisories/advisory%3A6683c29d-345d-4943-8ca3-33f9679ba298","group":{"id":"advisory:6683c29d-345d-4943-8ca3-33f9679ba298","revision":1,"primary_event_id":73235,"change":"published","superseded_by":[],"changed":{"id":73235,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-2rwc-vhgw-29v9","summary":"CGA-2rwc-vhgw-29v9","evidence":"osv:CGA-2rwc-vhgw-29v9","products":[{"name":{"value":"opensearch-fips-3-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2rwc-vhgw-29v9","aliases":["CGA-2rwc-vhgw-29v9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-sql","purl":"pkg:apk/chainguard/opensearch-fips-3-sql?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2rwc-vhgw-29v9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:17:07Z"}]}}],"modified":"2026-10-03T10:31:20.386765960Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6683c29d-345d-4943-8ca3-33f9679ba298","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2rwc-vhgw-29v9","advisory_id":"6683c29d-345d-4943-8ca3-33f9679ba298","event_types":["advisory"],"published_at":"2026-10-26T00:32:19.319252+00:00","technologies":["core-osv","opensearch-fips-3-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:22:02+00:00","detail_url":"/events/73235"},"members":[{"id":73235,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-2rwc-vhgw-29v9","summary":"CGA-2rwc-vhgw-29v9","evidence":"osv:CGA-2rwc-vhgw-29v9","products":[{"name":{"value":"opensearch-fips-3-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2rwc-vhgw-29v9","aliases":["CGA-2rwc-vhgw-29v9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-sql","purl":"pkg:apk/chainguard/opensearch-fips-3-sql?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2rwc-vhgw-29v9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:17:07Z"}]}}],"modified":"2026-10-03T10:31:20.386765960Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6683c29d-345d-4943-8ca3-33f9679ba298","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2rwc-vhgw-29v9","advisory_id":"6683c29d-345d-4943-8ca3-33f9679ba298","event_types":["advisory"],"published_at":"2026-10-26T00:32:19.319252+00:00","technologies":["core-osv","opensearch-fips-3-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:22:02+00:00","detail_url":"/events/73235"}]}},{"id":72534,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-2m7q-4wj3-qmg9","summary":"CGA-2m7q-4wj3-qmg9","evidence":"osv:CGA-2m7q-4wj3-qmg9","products":[{"name":{"value":"apache-nifi-registry-2.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2m7q-4wj3-qmg9","aliases":["CGA-2m7q-4wj3-qmg9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"apache-nifi-registry-2.11","purl":"pkg:apk/chainguard/apache-nifi-registry-2.11?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2m7q-4wj3-qmg9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/nifi-registry/nifi-registry-2.11.0/lib/nifi-registry-web-api-2.11.0.war","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:03:18Z"}]}}],"modified":"2026-10-03T10:31:13.613554895Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:edfbceec-7132-462c-a6ce-ef33c0751ca1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2m7q-4wj3-qmg9","advisory_id":"edfbceec-7132-462c-a6ce-ef33c0751ca1","event_types":["advisory"],"published_at":"2026-10-26T00:29:13.513958+00:00","technologies":["apache-nifi-registry-2-11","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:25:22+00:00","detail_url":"/advisories/advisory%3Aedfbceec-7132-462c-a6ce-ef33c0751ca1","group":{"id":"advisory:edfbceec-7132-462c-a6ce-ef33c0751ca1","revision":1,"primary_event_id":73197,"change":"published","superseded_by":[],"changed":{"id":73197,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-2m7q-4wj3-qmg9","summary":"CGA-2m7q-4wj3-qmg9","evidence":"osv:CGA-2m7q-4wj3-qmg9","products":[{"name":{"value":"apache-nifi-registry-2.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2m7q-4wj3-qmg9","aliases":["CGA-2m7q-4wj3-qmg9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"apache-nifi-registry-2.11","purl":"pkg:apk/chainguard/apache-nifi-registry-2.11?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2m7q-4wj3-qmg9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/nifi-registry/nifi-registry-2.11.0/lib/nifi-registry-web-api-2.11.0.war","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:03:18Z"}]}}],"modified":"2026-10-03T10:31:13.613554895Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:edfbceec-7132-462c-a6ce-ef33c0751ca1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2m7q-4wj3-qmg9","advisory_id":"edfbceec-7132-462c-a6ce-ef33c0751ca1","event_types":["advisory"],"published_at":"2026-10-26T00:29:13.513958+00:00","technologies":["apache-nifi-registry-2-11","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:25:22+00:00","detail_url":"/events/73197"},"members":[{"id":73197,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-2m7q-4wj3-qmg9","summary":"CGA-2m7q-4wj3-qmg9","evidence":"osv:CGA-2m7q-4wj3-qmg9","products":[{"name":{"value":"apache-nifi-registry-2.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2m7q-4wj3-qmg9","aliases":["CGA-2m7q-4wj3-qmg9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"apache-nifi-registry-2.11","purl":"pkg:apk/chainguard/apache-nifi-registry-2.11?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2m7q-4wj3-qmg9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/nifi-registry/nifi-registry-2.11.0/lib/nifi-registry-web-api-2.11.0.war","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:03:18Z"}]}}],"modified":"2026-10-03T10:31:13.613554895Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:edfbceec-7132-462c-a6ce-ef33c0751ca1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2m7q-4wj3-qmg9","advisory_id":"edfbceec-7132-462c-a6ce-ef33c0751ca1","event_types":["advisory"],"published_at":"2026-10-26T00:29:13.513958+00:00","technologies":["apache-nifi-registry-2-11","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:25:22+00:00","detail_url":"/events/73197"}]}},{"id":72222,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-vc3m-ghq4-j8p9","summary":"CGA-vc3m-ghq4-j8p9","evidence":"osv:CGA-vc3m-ghq4-j8p9","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vc3m-ghq4-j8p9","aliases":["CGA-vc3m-ghq4-j8p9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vc3m-ghq4-j8p9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:39:09Z"}]}}],"modified":"2026-10-02T23:01:48.215125577Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3a7d8aea-1dce-4a13-b79f-a08adfde0064","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vc3m-ghq4-j8p9","advisory_id":"3a7d8aea-1dce-4a13-b79f-a08adfde0064","event_types":["advisory"],"published_at":"2026-10-26T00:19:05.698644+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:37:00+00:00","detail_url":"/advisories/advisory%3A3a7d8aea-1dce-4a13-b79f-a08adfde0064","group":{"id":"advisory:3a7d8aea-1dce-4a13-b79f-a08adfde0064","revision":1,"primary_event_id":72867,"change":"published","superseded_by":[],"changed":{"id":72867,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-vc3m-ghq4-j8p9","summary":"CGA-vc3m-ghq4-j8p9","evidence":"osv:CGA-vc3m-ghq4-j8p9","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vc3m-ghq4-j8p9","aliases":["CGA-vc3m-ghq4-j8p9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vc3m-ghq4-j8p9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:39:09Z"}]}}],"modified":"2026-10-02T23:01:48.215125577Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3a7d8aea-1dce-4a13-b79f-a08adfde0064","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vc3m-ghq4-j8p9","advisory_id":"3a7d8aea-1dce-4a13-b79f-a08adfde0064","event_types":["advisory"],"published_at":"2026-10-26T00:19:05.698644+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:37:00+00:00","detail_url":"/events/72867"},"members":[{"id":72867,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-vc3m-ghq4-j8p9","summary":"CGA-vc3m-ghq4-j8p9","evidence":"osv:CGA-vc3m-ghq4-j8p9","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vc3m-ghq4-j8p9","aliases":["CGA-vc3m-ghq4-j8p9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vc3m-ghq4-j8p9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:39:09Z"}]}}],"modified":"2026-10-02T23:01:48.215125577Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3a7d8aea-1dce-4a13-b79f-a08adfde0064","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vc3m-ghq4-j8p9","advisory_id":"3a7d8aea-1dce-4a13-b79f-a08adfde0064","event_types":["advisory"],"published_at":"2026-10-26T00:19:05.698644+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:37:00+00:00","detail_url":"/events/72867"}]}}],"next_after":72945,"next_before":72222}