{"schema_version":"2","view":"grouped","data":[{"id":72727,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5v3m-qccw-984v","summary":"CGA-5v3m-qccw-984v","evidence":"osv:CGA-5v3m-qccw-984v","products":[{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5v3m-qccw-984v","aliases":["CGA-5v3m-qccw-984v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-3-repository-s3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v3m-qccw-984v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:24:18Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/wolfi/opensearch-3-repository-s3?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v3m-qccw-984v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:24:18Z"}]}}],"modified":"2026-10-03T10:32:33.162975949Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e270734d-c395-463f-82f4-bc7c4899f76a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5v3m-qccw-984v","advisory_id":"e270734d-c395-463f-82f4-bc7c4899f76a","event_types":["advisory"],"published_at":"2026-10-26T00:54:18.39072+00:00","technologies":["core-osv","opensearch-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:12:51+00:00","detail_url":"/advisories/advisory%3Ae270734d-c395-463f-82f4-bc7c4899f76a","group":{"id":"advisory:e270734d-c395-463f-82f4-bc7c4899f76a","revision":1,"primary_event_id":73474,"change":"published","superseded_by":[],"changed":{"id":73474,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5v3m-qccw-984v","summary":"CGA-5v3m-qccw-984v","evidence":"osv:CGA-5v3m-qccw-984v","products":[{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5v3m-qccw-984v","aliases":["CGA-5v3m-qccw-984v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-3-repository-s3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v3m-qccw-984v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:24:18Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/wolfi/opensearch-3-repository-s3?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v3m-qccw-984v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:24:18Z"}]}}],"modified":"2026-10-03T10:32:33.162975949Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e270734d-c395-463f-82f4-bc7c4899f76a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5v3m-qccw-984v","advisory_id":"e270734d-c395-463f-82f4-bc7c4899f76a","event_types":["advisory"],"published_at":"2026-10-26T00:54:18.39072+00:00","technologies":["core-osv","opensearch-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:12:51+00:00","detail_url":"/events/73474"},"members":[{"id":73474,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5v3m-qccw-984v","summary":"CGA-5v3m-qccw-984v","evidence":"osv:CGA-5v3m-qccw-984v","products":[{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-repository-s3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5v3m-qccw-984v","aliases":["CGA-5v3m-qccw-984v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-3-repository-s3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v3m-qccw-984v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:24:18Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-repository-s3","purl":"pkg:apk/wolfi/opensearch-3-repository-s3?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v3m-qccw-984v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:24:18Z"}]}}],"modified":"2026-10-03T10:32:33.162975949Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e270734d-c395-463f-82f4-bc7c4899f76a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5v3m-qccw-984v","advisory_id":"e270734d-c395-463f-82f4-bc7c4899f76a","event_types":["advisory"],"published_at":"2026-10-26T00:54:18.39072+00:00","technologies":["core-osv","opensearch-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:12:51+00:00","detail_url":"/events/73474"}]}},{"id":72723,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5q7f-9jwc-3c7h","summary":"CGA-5q7f-9jwc-3c7h","evidence":"osv:CGA-5q7f-9jwc-3c7h","products":[{"name":{"value":"opensearch-fips-3-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5q7f-9jwc-3c7h","aliases":["CGA-5q7f-9jwc-3c7h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-crypto-kms","purl":"pkg:apk/chainguard/opensearch-fips-3-crypto-kms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5q7f-9jwc-3c7h.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:54:06Z"}]}}],"modified":"2026-10-03T10:32:32.758172704Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:68c80140-3849-4709-a434-e093db560d21","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5q7f-9jwc-3c7h","advisory_id":"68c80140-3849-4709-a434-e093db560d21","event_types":["advisory"],"published_at":"2026-10-26T00:53:51.111778+00:00","technologies":["core-osv","opensearch-fips-3-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:54:16+00:00","detail_url":"/advisories/advisory%3A68c80140-3849-4709-a434-e093db560d21","group":{"id":"advisory:68c80140-3849-4709-a434-e093db560d21","revision":1,"primary_event_id":73469,"change":"published","superseded_by":[],"changed":{"id":73469,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5q7f-9jwc-3c7h","summary":"CGA-5q7f-9jwc-3c7h","evidence":"osv:CGA-5q7f-9jwc-3c7h","products":[{"name":{"value":"opensearch-fips-3-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5q7f-9jwc-3c7h","aliases":["CGA-5q7f-9jwc-3c7h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-crypto-kms","purl":"pkg:apk/chainguard/opensearch-fips-3-crypto-kms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5q7f-9jwc-3c7h.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:54:06Z"}]}}],"modified":"2026-10-03T10:32:32.758172704Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:68c80140-3849-4709-a434-e093db560d21","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5q7f-9jwc-3c7h","advisory_id":"68c80140-3849-4709-a434-e093db560d21","event_types":["advisory"],"published_at":"2026-10-26T00:53:51.111778+00:00","technologies":["core-osv","opensearch-fips-3-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:54:16+00:00","detail_url":"/events/73469"},"members":[{"id":73469,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5q7f-9jwc-3c7h","summary":"CGA-5q7f-9jwc-3c7h","evidence":"osv:CGA-5q7f-9jwc-3c7h","products":[{"name":{"value":"opensearch-fips-3-crypto-kms","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5q7f-9jwc-3c7h","aliases":["CGA-5q7f-9jwc-3c7h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-crypto-kms","purl":"pkg:apk/chainguard/opensearch-fips-3-crypto-kms?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5q7f-9jwc-3c7h.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-crypto-kms/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:54:06Z"}]}}],"modified":"2026-10-03T10:32:32.758172704Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:68c80140-3849-4709-a434-e093db560d21","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5q7f-9jwc-3c7h","advisory_id":"68c80140-3849-4709-a434-e093db560d21","event_types":["advisory"],"published_at":"2026-10-26T00:53:51.111778+00:00","technologies":["core-osv","opensearch-fips-3-crypto-kms"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:54:16+00:00","detail_url":"/events/73469"}]}},{"id":72707,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5h93-2672-35q3","summary":"CGA-5h93-2672-35q3","evidence":"osv:CGA-5h93-2672-35q3","products":[{"name":{"value":"opensearch-fips-3-alerting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5h93-2672-35q3","aliases":["CGA-5h93-2672-35q3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-alerting","purl":"pkg:apk/chainguard/opensearch-fips-3-alerting?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5h93-2672-35q3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:49:07Z"}]}}],"modified":"2026-10-03T10:32:30.496086634Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:089aa8eb-b399-40db-859c-16c270d9b00e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5h93-2672-35q3","advisory_id":"089aa8eb-b399-40db-859c-16c270d9b00e","event_types":["advisory"],"published_at":"2026-10-26T00:51:12.341687+00:00","technologies":["core-osv","opensearch-fips-3-alerting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:58:24+00:00","detail_url":"/advisories/advisory%3A089aa8eb-b399-40db-859c-16c270d9b00e","group":{"id":"advisory:089aa8eb-b399-40db-859c-16c270d9b00e","revision":1,"primary_event_id":73444,"change":"published","superseded_by":[],"changed":{"id":73444,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5h93-2672-35q3","summary":"CGA-5h93-2672-35q3","evidence":"osv:CGA-5h93-2672-35q3","products":[{"name":{"value":"opensearch-fips-3-alerting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5h93-2672-35q3","aliases":["CGA-5h93-2672-35q3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-alerting","purl":"pkg:apk/chainguard/opensearch-fips-3-alerting?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5h93-2672-35q3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:49:07Z"}]}}],"modified":"2026-10-03T10:32:30.496086634Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:089aa8eb-b399-40db-859c-16c270d9b00e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5h93-2672-35q3","advisory_id":"089aa8eb-b399-40db-859c-16c270d9b00e","event_types":["advisory"],"published_at":"2026-10-26T00:51:12.341687+00:00","technologies":["core-osv","opensearch-fips-3-alerting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:58:24+00:00","detail_url":"/events/73444"},"members":[{"id":73444,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5h93-2672-35q3","summary":"CGA-5h93-2672-35q3","evidence":"osv:CGA-5h93-2672-35q3","products":[{"name":{"value":"opensearch-fips-3-alerting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5h93-2672-35q3","aliases":["CGA-5h93-2672-35q3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-alerting","purl":"pkg:apk/chainguard/opensearch-fips-3-alerting?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5h93-2672-35q3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:49:07Z"}]}}],"modified":"2026-10-03T10:32:30.496086634Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:089aa8eb-b399-40db-859c-16c270d9b00e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5h93-2672-35q3","advisory_id":"089aa8eb-b399-40db-859c-16c270d9b00e","event_types":["advisory"],"published_at":"2026-10-26T00:51:12.341687+00:00","technologies":["core-osv","opensearch-fips-3-alerting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:58:24+00:00","detail_url":"/events/73444"}]}},{"id":72694,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-rg5c-h22v-3j6j","summary":"CGA-rg5c-h22v-3j6j","evidence":"osv:CGA-rg5c-h22v-3j6j","products":[{"name":{"value":"opensearch-fips-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rg5c-h22v-3j6j","aliases":["CGA-rg5c-h22v-3j6j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-fips-3-repository-s3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rg5c-h22v-3j6j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:09:08Z"}]}}],"modified":"2026-10-03T10:32:20.178077023Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:aa75f0c7-a6ff-485e-99f3-5e2a9b1d0cc2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rg5c-h22v-3j6j","advisory_id":"aa75f0c7-a6ff-485e-99f3-5e2a9b1d0cc2","event_types":["advisory"],"published_at":"2026-10-26T00:49:15.370225+00:00","technologies":["core-osv","opensearch-fips-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:18:09+00:00","detail_url":"/advisories/advisory%3Aaa75f0c7-a6ff-485e-99f3-5e2a9b1d0cc2","group":{"id":"advisory:aa75f0c7-a6ff-485e-99f3-5e2a9b1d0cc2","revision":1,"primary_event_id":73422,"change":"published","superseded_by":[],"changed":{"id":73422,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-rg5c-h22v-3j6j","summary":"CGA-rg5c-h22v-3j6j","evidence":"osv:CGA-rg5c-h22v-3j6j","products":[{"name":{"value":"opensearch-fips-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rg5c-h22v-3j6j","aliases":["CGA-rg5c-h22v-3j6j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-fips-3-repository-s3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rg5c-h22v-3j6j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:09:08Z"}]}}],"modified":"2026-10-03T10:32:20.178077023Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:aa75f0c7-a6ff-485e-99f3-5e2a9b1d0cc2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rg5c-h22v-3j6j","advisory_id":"aa75f0c7-a6ff-485e-99f3-5e2a9b1d0cc2","event_types":["advisory"],"published_at":"2026-10-26T00:49:15.370225+00:00","technologies":["core-osv","opensearch-fips-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:18:09+00:00","detail_url":"/events/73422"},"members":[{"id":73422,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-rg5c-h22v-3j6j","summary":"CGA-rg5c-h22v-3j6j","evidence":"osv:CGA-rg5c-h22v-3j6j","products":[{"name":{"value":"opensearch-fips-3-repository-s3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rg5c-h22v-3j6j","aliases":["CGA-rg5c-h22v-3j6j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-repository-s3","purl":"pkg:apk/chainguard/opensearch-fips-3-repository-s3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rg5c-h22v-3j6j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-repository-s3/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:09:08Z"}]}}],"modified":"2026-10-03T10:32:20.178077023Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:aa75f0c7-a6ff-485e-99f3-5e2a9b1d0cc2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rg5c-h22v-3j6j","advisory_id":"aa75f0c7-a6ff-485e-99f3-5e2a9b1d0cc2","event_types":["advisory"],"published_at":"2026-10-26T00:49:15.370225+00:00","technologies":["core-osv","opensearch-fips-3-repository-s3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:18:09+00:00","detail_url":"/events/73422"}]}},{"id":72691,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-pv28-c8fg-cw9g","summary":"CGA-pv28-c8fg-cw9g","evidence":"osv:CGA-pv28-c8fg-cw9g","products":[{"name":{"value":"opensearch-3-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-performance-analyzer","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pv28-c8fg-cw9g","aliases":["CGA-pv28-c8fg-cw9g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-3-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pv28-c8fg-cw9g.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:41Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-performance-analyzer","purl":"pkg:apk/wolfi/opensearch-3-performance-analyzer?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pv28-c8fg-cw9g.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:41Z"}]}}],"modified":"2026-10-03T10:32:08.908915505Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b849e4b0-f02e-4fea-af54-12a8688aa797","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pv28-c8fg-cw9g","advisory_id":"b849e4b0-f02e-4fea-af54-12a8688aa797","event_types":["advisory"],"published_at":"2026-10-26T00:48:53.671619+00:00","technologies":["core-osv","opensearch-3-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:06:08+00:00","detail_url":"/advisories/advisory%3Ab849e4b0-f02e-4fea-af54-12a8688aa797","group":{"id":"advisory:b849e4b0-f02e-4fea-af54-12a8688aa797","revision":1,"primary_event_id":73419,"change":"published","superseded_by":[],"changed":{"id":73419,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-pv28-c8fg-cw9g","summary":"CGA-pv28-c8fg-cw9g","evidence":"osv:CGA-pv28-c8fg-cw9g","products":[{"name":{"value":"opensearch-3-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-performance-analyzer","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pv28-c8fg-cw9g","aliases":["CGA-pv28-c8fg-cw9g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-3-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pv28-c8fg-cw9g.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:41Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-performance-analyzer","purl":"pkg:apk/wolfi/opensearch-3-performance-analyzer?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pv28-c8fg-cw9g.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:41Z"}]}}],"modified":"2026-10-03T10:32:08.908915505Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b849e4b0-f02e-4fea-af54-12a8688aa797","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pv28-c8fg-cw9g","advisory_id":"b849e4b0-f02e-4fea-af54-12a8688aa797","event_types":["advisory"],"published_at":"2026-10-26T00:48:53.671619+00:00","technologies":["core-osv","opensearch-3-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:06:08+00:00","detail_url":"/events/73419"},"members":[{"id":73419,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-pv28-c8fg-cw9g","summary":"CGA-pv28-c8fg-cw9g","evidence":"osv:CGA-pv28-c8fg-cw9g","products":[{"name":{"value":"opensearch-3-performance-analyzer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-performance-analyzer","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pv28-c8fg-cw9g","aliases":["CGA-pv28-c8fg-cw9g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-performance-analyzer","purl":"pkg:apk/chainguard/opensearch-3-performance-analyzer?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pv28-c8fg-cw9g.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:41Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-performance-analyzer","purl":"pkg:apk/wolfi/opensearch-3-performance-analyzer?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pv28-c8fg-cw9g.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-performance-analyzer/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:41Z"}]}}],"modified":"2026-10-03T10:32:08.908915505Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b849e4b0-f02e-4fea-af54-12a8688aa797","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pv28-c8fg-cw9g","advisory_id":"b849e4b0-f02e-4fea-af54-12a8688aa797","event_types":["advisory"],"published_at":"2026-10-26T00:48:53.671619+00:00","technologies":["core-osv","opensearch-3-performance-analyzer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:06:08+00:00","detail_url":"/events/73419"}]}},{"id":72686,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-35m4-76mf-82p3","summary":"CGA-35m4-76mf-82p3","evidence":"osv:CGA-35m4-76mf-82p3","products":[{"name":{"value":"opensearch-fips-3-security","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-35m4-76mf-82p3","aliases":["CGA-35m4-76mf-82p3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-security","purl":"pkg:apk/chainguard/opensearch-fips-3-security?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35m4-76mf-82p3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-security/opensaml-3.9.0.0-all.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:31:23Z"}]}}],"modified":"2026-10-03T10:31:31.740843845Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e4a7c343-ebb7-4560-b745-faf68b928c7d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35m4-76mf-82p3","advisory_id":"e4a7c343-ebb7-4560-b745-faf68b928c7d","event_types":["advisory"],"published_at":"2026-10-26T00:47:10.545783+00:00","technologies":["core-osv","opensearch-fips-3-security"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:36:58+00:00","detail_url":"/advisories/advisory%3Ae4a7c343-ebb7-4560-b745-faf68b928c7d","group":{"id":"advisory:e4a7c343-ebb7-4560-b745-faf68b928c7d","revision":1,"primary_event_id":73413,"change":"published","superseded_by":[],"changed":{"id":73413,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-35m4-76mf-82p3","summary":"CGA-35m4-76mf-82p3","evidence":"osv:CGA-35m4-76mf-82p3","products":[{"name":{"value":"opensearch-fips-3-security","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-35m4-76mf-82p3","aliases":["CGA-35m4-76mf-82p3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-security","purl":"pkg:apk/chainguard/opensearch-fips-3-security?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35m4-76mf-82p3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-security/opensaml-3.9.0.0-all.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:31:23Z"}]}}],"modified":"2026-10-03T10:31:31.740843845Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e4a7c343-ebb7-4560-b745-faf68b928c7d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35m4-76mf-82p3","advisory_id":"e4a7c343-ebb7-4560-b745-faf68b928c7d","event_types":["advisory"],"published_at":"2026-10-26T00:47:10.545783+00:00","technologies":["core-osv","opensearch-fips-3-security"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:36:58+00:00","detail_url":"/events/73413"},"members":[{"id":73413,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-35m4-76mf-82p3","summary":"CGA-35m4-76mf-82p3","evidence":"osv:CGA-35m4-76mf-82p3","products":[{"name":{"value":"opensearch-fips-3-security","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-35m4-76mf-82p3","aliases":["CGA-35m4-76mf-82p3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-security","purl":"pkg:apk/chainguard/opensearch-fips-3-security?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35m4-76mf-82p3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-security/opensaml-3.9.0.0-all.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:31:23Z"}]}}],"modified":"2026-10-03T10:31:31.740843845Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e4a7c343-ebb7-4560-b745-faf68b928c7d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35m4-76mf-82p3","advisory_id":"e4a7c343-ebb7-4560-b745-faf68b928c7d","event_types":["advisory"],"published_at":"2026-10-26T00:47:10.545783+00:00","technologies":["core-osv","opensearch-fips-3-security"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:36:58+00:00","detail_url":"/events/73413"}]}},{"id":72682,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-44pm-r22f-jm3j","summary":"CGA-44pm-r22f-jm3j","evidence":"osv:CGA-44pm-r22f-jm3j","products":[{"name":{"value":"opensearch-fips-3-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-44pm-r22f-jm3j","aliases":["CGA-44pm-r22f-jm3j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-sql","purl":"pkg:apk/chainguard/opensearch-fips-3-sql?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-44pm-r22f-jm3j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:17:07Z"}]}}],"modified":"2026-10-03T10:32:03.215281418Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:acf020b7-7a16-4bfd-95bb-f8397f76bd43","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-44pm-r22f-jm3j","advisory_id":"acf020b7-7a16-4bfd-95bb-f8397f76bd43","event_types":["advisory"],"published_at":"2026-10-26T00:46:51.697282+00:00","technologies":["core-osv","opensearch-fips-3-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:22:01+00:00","detail_url":"/advisories/advisory%3Aacf020b7-7a16-4bfd-95bb-f8397f76bd43","group":{"id":"advisory:acf020b7-7a16-4bfd-95bb-f8397f76bd43","revision":1,"primary_event_id":73409,"change":"published","superseded_by":[],"changed":{"id":73409,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-44pm-r22f-jm3j","summary":"CGA-44pm-r22f-jm3j","evidence":"osv:CGA-44pm-r22f-jm3j","products":[{"name":{"value":"opensearch-fips-3-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-44pm-r22f-jm3j","aliases":["CGA-44pm-r22f-jm3j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-sql","purl":"pkg:apk/chainguard/opensearch-fips-3-sql?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-44pm-r22f-jm3j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:17:07Z"}]}}],"modified":"2026-10-03T10:32:03.215281418Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:acf020b7-7a16-4bfd-95bb-f8397f76bd43","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-44pm-r22f-jm3j","advisory_id":"acf020b7-7a16-4bfd-95bb-f8397f76bd43","event_types":["advisory"],"published_at":"2026-10-26T00:46:51.697282+00:00","technologies":["core-osv","opensearch-fips-3-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:22:01+00:00","detail_url":"/events/73409"},"members":[{"id":73409,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-44pm-r22f-jm3j","summary":"CGA-44pm-r22f-jm3j","evidence":"osv:CGA-44pm-r22f-jm3j","products":[{"name":{"value":"opensearch-fips-3-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-44pm-r22f-jm3j","aliases":["CGA-44pm-r22f-jm3j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-sql","purl":"pkg:apk/chainguard/opensearch-fips-3-sql?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-44pm-r22f-jm3j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T04:17:07Z"}]}}],"modified":"2026-10-03T10:32:03.215281418Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:acf020b7-7a16-4bfd-95bb-f8397f76bd43","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-44pm-r22f-jm3j","advisory_id":"acf020b7-7a16-4bfd-95bb-f8397f76bd43","event_types":["advisory"],"published_at":"2026-10-26T00:46:51.697282+00:00","technologies":["core-osv","opensearch-fips-3-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:22:01+00:00","detail_url":"/events/73409"}]}},{"id":72631,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-469m-g9q7-2q9v","summary":"CGA-469m-g9q7-2q9v","evidence":"osv:CGA-469m-g9q7-2q9v","products":[{"name":{"value":"opensearch-fips-3-security","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-469m-g9q7-2q9v","aliases":["CGA-469m-g9q7-2q9v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-security","purl":"pkg:apk/chainguard/opensearch-fips-3-security?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-469m-g9q7-2q9v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:31:21Z"}]}}],"modified":"2026-10-03T10:32:05.958249940Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:57e95e3b-da63-4217-8100-ccbebd7672af","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-469m-g9q7-2q9v","advisory_id":"57e95e3b-da63-4217-8100-ccbebd7672af","event_types":["advisory"],"published_at":"2026-10-26T00:41:14.258343+00:00","technologies":["core-osv","opensearch-fips-3-security"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:37:58+00:00","detail_url":"/advisories/advisory%3A57e95e3b-da63-4217-8100-ccbebd7672af","group":{"id":"advisory:57e95e3b-da63-4217-8100-ccbebd7672af","revision":1,"primary_event_id":73341,"change":"published","superseded_by":[],"changed":{"id":73341,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-469m-g9q7-2q9v","summary":"CGA-469m-g9q7-2q9v","evidence":"osv:CGA-469m-g9q7-2q9v","products":[{"name":{"value":"opensearch-fips-3-security","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-469m-g9q7-2q9v","aliases":["CGA-469m-g9q7-2q9v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-security","purl":"pkg:apk/chainguard/opensearch-fips-3-security?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-469m-g9q7-2q9v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:31:21Z"}]}}],"modified":"2026-10-03T10:32:05.958249940Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:57e95e3b-da63-4217-8100-ccbebd7672af","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-469m-g9q7-2q9v","advisory_id":"57e95e3b-da63-4217-8100-ccbebd7672af","event_types":["advisory"],"published_at":"2026-10-26T00:41:14.258343+00:00","technologies":["core-osv","opensearch-fips-3-security"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:37:58+00:00","detail_url":"/events/73341"},"members":[{"id":73341,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-469m-g9q7-2q9v","summary":"CGA-469m-g9q7-2q9v","evidence":"osv:CGA-469m-g9q7-2q9v","products":[{"name":{"value":"opensearch-fips-3-security","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-469m-g9q7-2q9v","aliases":["CGA-469m-g9q7-2q9v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-security","purl":"pkg:apk/chainguard/opensearch-fips-3-security?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-469m-g9q7-2q9v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-security/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:31:21Z"}]}}],"modified":"2026-10-03T10:32:05.958249940Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:57e95e3b-da63-4217-8100-ccbebd7672af","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-469m-g9q7-2q9v","advisory_id":"57e95e3b-da63-4217-8100-ccbebd7672af","event_types":["advisory"],"published_at":"2026-10-26T00:41:14.258343+00:00","technologies":["core-osv","opensearch-fips-3-security"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:37:58+00:00","detail_url":"/events/73341"}]}},{"id":72615,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5v7m-cm24-wrx2","summary":"CGA-5v7m-cm24-wrx2","evidence":"osv:CGA-5v7m-cm24-wrx2","products":[{"name":{"value":"opensearch-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-observability","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5v7m-cm24-wrx2","aliases":["CGA-5v7m-cm24-wrx2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/chainguard/opensearch-3-observability?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v7m-cm24-wrx2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:44:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/wolfi/opensearch-3-observability?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v7m-cm24-wrx2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:44:08Z"}]}}],"modified":"2026-10-03T10:30:16.494469549Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f7151a23-0c8e-4012-a32f-853ec7f0c303","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5v7m-cm24-wrx2","advisory_id":"f7151a23-0c8e-4012-a32f-853ec7f0c303","event_types":["advisory"],"published_at":"2026-10-26T00:39:05.874237+00:00","technologies":["core-osv","opensearch-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:55:26+00:00","detail_url":"/advisories/advisory%3Af7151a23-0c8e-4012-a32f-853ec7f0c303","group":{"id":"advisory:f7151a23-0c8e-4012-a32f-853ec7f0c303","revision":1,"primary_event_id":73313,"change":"published","superseded_by":[],"changed":{"id":73313,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5v7m-cm24-wrx2","summary":"CGA-5v7m-cm24-wrx2","evidence":"osv:CGA-5v7m-cm24-wrx2","products":[{"name":{"value":"opensearch-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-observability","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5v7m-cm24-wrx2","aliases":["CGA-5v7m-cm24-wrx2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/chainguard/opensearch-3-observability?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v7m-cm24-wrx2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:44:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/wolfi/opensearch-3-observability?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v7m-cm24-wrx2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:44:08Z"}]}}],"modified":"2026-10-03T10:30:16.494469549Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f7151a23-0c8e-4012-a32f-853ec7f0c303","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5v7m-cm24-wrx2","advisory_id":"f7151a23-0c8e-4012-a32f-853ec7f0c303","event_types":["advisory"],"published_at":"2026-10-26T00:39:05.874237+00:00","technologies":["core-osv","opensearch-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:55:26+00:00","detail_url":"/events/73313"},"members":[{"id":73313,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5v7m-cm24-wrx2","summary":"CGA-5v7m-cm24-wrx2","evidence":"osv:CGA-5v7m-cm24-wrx2","products":[{"name":{"value":"opensearch-3-observability","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-observability","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5v7m-cm24-wrx2","aliases":["CGA-5v7m-cm24-wrx2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/chainguard/opensearch-3-observability?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v7m-cm24-wrx2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:44:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-observability","purl":"pkg:apk/wolfi/opensearch-3-observability?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5v7m-cm24-wrx2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.1","component_type":"java-archive","component_version":"3.2.1","component_location":"/usr/share/opensearch/plugins/opensearch-observability/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:44:08Z"}]}}],"modified":"2026-10-03T10:30:16.494469549Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f7151a23-0c8e-4012-a32f-853ec7f0c303","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5v7m-cm24-wrx2","advisory_id":"f7151a23-0c8e-4012-a32f-853ec7f0c303","event_types":["advisory"],"published_at":"2026-10-26T00:39:05.874237+00:00","technologies":["core-osv","opensearch-3-observability"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:55:26+00:00","detail_url":"/events/73313"}]}},{"id":72611,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-pg27-w5wr-f6q9","summary":"CGA-pg27-w5wr-f6q9","evidence":"osv:CGA-pg27-w5wr-f6q9","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pg27-w5wr-f6q9","aliases":["CGA-pg27-w5wr-f6q9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pg27-w5wr-f6q9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:48Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pg27-w5wr-f6q9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:48Z"}]}}],"modified":"2026-10-03T10:31:57.092167016Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:61679c74-7fba-437c-af37-c2221d59de91","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pg27-w5wr-f6q9","advisory_id":"61679c74-7fba-437c-af37-c2221d59de91","event_types":["advisory"],"published_at":"2026-10-26T00:38:14.098655+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/advisories/advisory%3A61679c74-7fba-437c-af37-c2221d59de91","group":{"id":"advisory:61679c74-7fba-437c-af37-c2221d59de91","revision":1,"primary_event_id":73306,"change":"published","superseded_by":[],"changed":{"id":73306,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-pg27-w5wr-f6q9","summary":"CGA-pg27-w5wr-f6q9","evidence":"osv:CGA-pg27-w5wr-f6q9","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pg27-w5wr-f6q9","aliases":["CGA-pg27-w5wr-f6q9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pg27-w5wr-f6q9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:48Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pg27-w5wr-f6q9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:48Z"}]}}],"modified":"2026-10-03T10:31:57.092167016Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:61679c74-7fba-437c-af37-c2221d59de91","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pg27-w5wr-f6q9","advisory_id":"61679c74-7fba-437c-af37-c2221d59de91","event_types":["advisory"],"published_at":"2026-10-26T00:38:14.098655+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/events/73306"},"members":[{"id":73306,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-pg27-w5wr-f6q9","summary":"CGA-pg27-w5wr-f6q9","evidence":"osv:CGA-pg27-w5wr-f6q9","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pg27-w5wr-f6q9","aliases":["CGA-pg27-w5wr-f6q9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pg27-w5wr-f6q9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:48Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pg27-w5wr-f6q9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:48Z"}]}}],"modified":"2026-10-03T10:31:57.092167016Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:61679c74-7fba-437c-af37-c2221d59de91","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pg27-w5wr-f6q9","advisory_id":"61679c74-7fba-437c-af37-c2221d59de91","event_types":["advisory"],"published_at":"2026-10-26T00:38:14.098655+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/events/73306"}]}},{"id":72589,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-3c3g-h73q-j7p2","summary":"CGA-3c3g-h73q-j7p2","evidence":"osv:CGA-3c3g-h73q-j7p2","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3c3g-h73q-j7p2","aliases":["CGA-3c3g-h73q-j7p2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3c3g-h73q-j7p2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3c3g-h73q-j7p2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}}],"modified":"2026-10-03T10:31:37.731442716Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6ef57540-f3f7-4d55-8ce3-f5a54e351b2d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3c3g-h73q-j7p2","advisory_id":"6ef57540-f3f7-4d55-8ce3-f5a54e351b2d","event_types":["advisory"],"published_at":"2026-10-26T00:35:47.735586+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/advisories/advisory%3A6ef57540-f3f7-4d55-8ce3-f5a54e351b2d","group":{"id":"advisory:6ef57540-f3f7-4d55-8ce3-f5a54e351b2d","revision":1,"primary_event_id":73273,"change":"published","superseded_by":[],"changed":{"id":73273,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-3c3g-h73q-j7p2","summary":"CGA-3c3g-h73q-j7p2","evidence":"osv:CGA-3c3g-h73q-j7p2","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3c3g-h73q-j7p2","aliases":["CGA-3c3g-h73q-j7p2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3c3g-h73q-j7p2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3c3g-h73q-j7p2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}}],"modified":"2026-10-03T10:31:37.731442716Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6ef57540-f3f7-4d55-8ce3-f5a54e351b2d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3c3g-h73q-j7p2","advisory_id":"6ef57540-f3f7-4d55-8ce3-f5a54e351b2d","event_types":["advisory"],"published_at":"2026-10-26T00:35:47.735586+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/events/73273"},"members":[{"id":73273,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-3c3g-h73q-j7p2","summary":"CGA-3c3g-h73q-j7p2","evidence":"osv:CGA-3c3g-h73q-j7p2","products":[{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"logstash-9.3-iamguarded-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3c3g-h73q-j7p2","aliases":["CGA-3c3g-h73q-j7p2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3c3g-h73q-j7p2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"logstash-9.3-iamguarded-compat","purl":"pkg:apk/wolfi/logstash-9.3-iamguarded-compat?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3c3g-h73q-j7p2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.4","component_type":"java-archive","component_version":"2.21.4","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.4.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T00:47:47Z"}]}}],"modified":"2026-10-03T10:31:37.731442716Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6ef57540-f3f7-4d55-8ce3-f5a54e351b2d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3c3g-h73q-j7p2","advisory_id":"6ef57540-f3f7-4d55-8ce3-f5a54e351b2d","event_types":["advisory"],"published_at":"2026-10-26T00:35:47.735586+00:00","technologies":["core-osv","logstash-9-3-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:56+00:00","detail_url":"/events/73273"}]}},{"id":72587,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-2h5r-3m4f-6hp3","summary":"CGA-2h5r-3m4f-6hp3","evidence":"osv:CGA-2h5r-3m4f-6hp3","products":[{"name":{"value":"opensearch-3-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-ml-commons","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2h5r-3m4f-6hp3","aliases":["CGA-2h5r-3m4f-6hp3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-ml-commons","purl":"pkg:apk/chainguard/opensearch-3-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h5r-3m4f-6hp3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:38:39Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-ml-commons","purl":"pkg:apk/wolfi/opensearch-3-ml-commons?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h5r-3m4f-6hp3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:38:39Z"}]}}],"modified":"2026-10-03T10:31:10.369892312Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:706845c2-bb97-44f7-863e-7aaa5cc9037e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2h5r-3m4f-6hp3","advisory_id":"706845c2-bb97-44f7-863e-7aaa5cc9037e","event_types":["advisory"],"published_at":"2026-10-26T00:35:14.179722+00:00","technologies":["core-osv","opensearch-3-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:38:54+00:00","detail_url":"/advisories/advisory%3A706845c2-bb97-44f7-863e-7aaa5cc9037e","group":{"id":"advisory:706845c2-bb97-44f7-863e-7aaa5cc9037e","revision":1,"primary_event_id":73268,"change":"published","superseded_by":[],"changed":{"id":73268,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-2h5r-3m4f-6hp3","summary":"CGA-2h5r-3m4f-6hp3","evidence":"osv:CGA-2h5r-3m4f-6hp3","products":[{"name":{"value":"opensearch-3-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-ml-commons","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2h5r-3m4f-6hp3","aliases":["CGA-2h5r-3m4f-6hp3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-ml-commons","purl":"pkg:apk/chainguard/opensearch-3-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h5r-3m4f-6hp3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:38:39Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-ml-commons","purl":"pkg:apk/wolfi/opensearch-3-ml-commons?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h5r-3m4f-6hp3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:38:39Z"}]}}],"modified":"2026-10-03T10:31:10.369892312Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:706845c2-bb97-44f7-863e-7aaa5cc9037e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2h5r-3m4f-6hp3","advisory_id":"706845c2-bb97-44f7-863e-7aaa5cc9037e","event_types":["advisory"],"published_at":"2026-10-26T00:35:14.179722+00:00","technologies":["core-osv","opensearch-3-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:38:54+00:00","detail_url":"/events/73268"},"members":[{"id":73268,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-2h5r-3m4f-6hp3","summary":"CGA-2h5r-3m4f-6hp3","evidence":"osv:CGA-2h5r-3m4f-6hp3","products":[{"name":{"value":"opensearch-3-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-ml-commons","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2h5r-3m4f-6hp3","aliases":["CGA-2h5r-3m4f-6hp3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-ml-commons","purl":"pkg:apk/chainguard/opensearch-3-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h5r-3m4f-6hp3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:38:39Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-ml-commons","purl":"pkg:apk/wolfi/opensearch-3-ml-commons?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h5r-3m4f-6hp3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:38:39Z"}]}}],"modified":"2026-10-03T10:31:10.369892312Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:706845c2-bb97-44f7-863e-7aaa5cc9037e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2h5r-3m4f-6hp3","advisory_id":"706845c2-bb97-44f7-863e-7aaa5cc9037e","event_types":["advisory"],"published_at":"2026-10-26T00:35:14.179722+00:00","technologies":["core-osv","opensearch-3-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:38:54+00:00","detail_url":"/events/73268"}]}},{"id":72560,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-36pf-mphc-hx87","summary":"CGA-36pf-mphc-hx87","evidence":"osv:CGA-36pf-mphc-hx87","products":[{"name":{"value":"opensearch-fips-3-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-36pf-mphc-hx87","aliases":["CGA-36pf-mphc-hx87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-ml-commons","purl":"pkg:apk/chainguard/opensearch-fips-3-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-36pf-mphc-hx87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:15:34Z"}]}}],"modified":"2026-10-03T10:31:31.278221701Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:965121f2-fabe-4417-8521-a00aa1d1583f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-36pf-mphc-hx87","advisory_id":"965121f2-fabe-4417-8521-a00aa1d1583f","event_types":["advisory"],"published_at":"2026-10-26T00:32:10.561888+00:00","technologies":["core-osv","opensearch-fips-3-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:44:40+00:00","detail_url":"/advisories/advisory%3A965121f2-fabe-4417-8521-a00aa1d1583f","group":{"id":"advisory:965121f2-fabe-4417-8521-a00aa1d1583f","revision":1,"primary_event_id":73234,"change":"published","superseded_by":[],"changed":{"id":73234,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-36pf-mphc-hx87","summary":"CGA-36pf-mphc-hx87","evidence":"osv:CGA-36pf-mphc-hx87","products":[{"name":{"value":"opensearch-fips-3-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-36pf-mphc-hx87","aliases":["CGA-36pf-mphc-hx87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-ml-commons","purl":"pkg:apk/chainguard/opensearch-fips-3-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-36pf-mphc-hx87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:15:34Z"}]}}],"modified":"2026-10-03T10:31:31.278221701Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:965121f2-fabe-4417-8521-a00aa1d1583f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-36pf-mphc-hx87","advisory_id":"965121f2-fabe-4417-8521-a00aa1d1583f","event_types":["advisory"],"published_at":"2026-10-26T00:32:10.561888+00:00","technologies":["core-osv","opensearch-fips-3-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:44:40+00:00","detail_url":"/events/73234"},"members":[{"id":73234,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-36pf-mphc-hx87","summary":"CGA-36pf-mphc-hx87","evidence":"osv:CGA-36pf-mphc-hx87","products":[{"name":{"value":"opensearch-fips-3-ml-commons","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-36pf-mphc-hx87","aliases":["CGA-36pf-mphc-hx87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-ml-commons","purl":"pkg:apk/chainguard/opensearch-fips-3-ml-commons?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-36pf-mphc-hx87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-ml/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:15:34Z"}]}}],"modified":"2026-10-03T10:31:31.278221701Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:965121f2-fabe-4417-8521-a00aa1d1583f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-36pf-mphc-hx87","advisory_id":"965121f2-fabe-4417-8521-a00aa1d1583f","event_types":["advisory"],"published_at":"2026-10-26T00:32:10.561888+00:00","technologies":["core-osv","opensearch-fips-3-ml-commons"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:44:40+00:00","detail_url":"/events/73234"}]}},{"id":72557,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xqg4-xcv6-phr9","summary":"CGA-xqg4-xcv6-phr9","evidence":"osv:CGA-xqg4-xcv6-phr9","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xqg4-xcv6-phr9","aliases":["CGA-xqg4-xcv6-phr9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqg4-xcv6-phr9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:06:48Z"}]}}],"modified":"2026-10-03T10:30:19.180095289Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d7e122c7-9fd8-4dbc-83d8-ff6d0e279ee3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqg4-xcv6-phr9","advisory_id":"d7e122c7-9fd8-4dbc-83d8-ff6d0e279ee3","event_types":["advisory"],"published_at":"2026-10-26T00:31:59.001647+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:14:03+00:00","detail_url":"/advisories/advisory%3Ad7e122c7-9fd8-4dbc-83d8-ff6d0e279ee3","group":{"id":"advisory:d7e122c7-9fd8-4dbc-83d8-ff6d0e279ee3","revision":1,"primary_event_id":73231,"change":"published","superseded_by":[],"changed":{"id":73231,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xqg4-xcv6-phr9","summary":"CGA-xqg4-xcv6-phr9","evidence":"osv:CGA-xqg4-xcv6-phr9","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xqg4-xcv6-phr9","aliases":["CGA-xqg4-xcv6-phr9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqg4-xcv6-phr9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:06:48Z"}]}}],"modified":"2026-10-03T10:30:19.180095289Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d7e122c7-9fd8-4dbc-83d8-ff6d0e279ee3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqg4-xcv6-phr9","advisory_id":"d7e122c7-9fd8-4dbc-83d8-ff6d0e279ee3","event_types":["advisory"],"published_at":"2026-10-26T00:31:59.001647+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:14:03+00:00","detail_url":"/events/73231"},"members":[{"id":73231,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xqg4-xcv6-phr9","summary":"CGA-xqg4-xcv6-phr9","evidence":"osv:CGA-xqg4-xcv6-phr9","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xqg4-xcv6-phr9","aliases":["CGA-xqg4-xcv6-phr9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqg4-xcv6-phr9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:06:48Z"}]}}],"modified":"2026-10-03T10:30:19.180095289Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d7e122c7-9fd8-4dbc-83d8-ff6d0e279ee3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqg4-xcv6-phr9","advisory_id":"d7e122c7-9fd8-4dbc-83d8-ff6d0e279ee3","event_types":["advisory"],"published_at":"2026-10-26T00:31:59.001647+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:14:03+00:00","detail_url":"/events/73231"}]}},{"id":72555,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-35c8-pp57-8x35","summary":"CGA-35c8-pp57-8x35","evidence":"osv:CGA-35c8-pp57-8x35","products":[{"name":{"value":"opensearch-fips-3-anomaly-detection","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-35c8-pp57-8x35","aliases":["CGA-35c8-pp57-8x35"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-anomaly-detection","purl":"pkg:apk/chainguard/opensearch-fips-3-anomaly-detection?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35c8-pp57-8x35.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:52:42Z"}]}}],"modified":"2026-10-03T10:31:30.444413587Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:640e3c76-7d33-4779-8813-90e63d740f59","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35c8-pp57-8x35","advisory_id":"640e3c76-7d33-4779-8813-90e63d740f59","event_types":["advisory"],"published_at":"2026-10-26T00:31:42.978483+00:00","technologies":["core-osv","opensearch-fips-3-anomaly-detection"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:01:37+00:00","detail_url":"/advisories/advisory%3A640e3c76-7d33-4779-8813-90e63d740f59","group":{"id":"advisory:640e3c76-7d33-4779-8813-90e63d740f59","revision":1,"primary_event_id":73229,"change":"published","superseded_by":[],"changed":{"id":73229,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-35c8-pp57-8x35","summary":"CGA-35c8-pp57-8x35","evidence":"osv:CGA-35c8-pp57-8x35","products":[{"name":{"value":"opensearch-fips-3-anomaly-detection","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-35c8-pp57-8x35","aliases":["CGA-35c8-pp57-8x35"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-anomaly-detection","purl":"pkg:apk/chainguard/opensearch-fips-3-anomaly-detection?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35c8-pp57-8x35.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:52:42Z"}]}}],"modified":"2026-10-03T10:31:30.444413587Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:640e3c76-7d33-4779-8813-90e63d740f59","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35c8-pp57-8x35","advisory_id":"640e3c76-7d33-4779-8813-90e63d740f59","event_types":["advisory"],"published_at":"2026-10-26T00:31:42.978483+00:00","technologies":["core-osv","opensearch-fips-3-anomaly-detection"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:01:37+00:00","detail_url":"/events/73229"},"members":[{"id":73229,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-35c8-pp57-8x35","summary":"CGA-35c8-pp57-8x35","evidence":"osv:CGA-35c8-pp57-8x35","products":[{"name":{"value":"opensearch-fips-3-anomaly-detection","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-35c8-pp57-8x35","aliases":["CGA-35c8-pp57-8x35"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-anomaly-detection","purl":"pkg:apk/chainguard/opensearch-fips-3-anomaly-detection?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35c8-pp57-8x35.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-anomaly-detection/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:52:42Z"}]}}],"modified":"2026-10-03T10:31:30.444413587Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:640e3c76-7d33-4779-8813-90e63d740f59","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35c8-pp57-8x35","advisory_id":"640e3c76-7d33-4779-8813-90e63d740f59","event_types":["advisory"],"published_at":"2026-10-26T00:31:42.978483+00:00","technologies":["core-osv","opensearch-fips-3-anomaly-detection"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:01:37+00:00","detail_url":"/events/73229"}]}},{"id":72536,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-fh6w-prcg-pxxj","summary":"CGA-fh6w-prcg-pxxj","evidence":"osv:CGA-fh6w-prcg-pxxj","products":[{"name":{"value":"opensearch-fips-3-discovery-ec2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fh6w-prcg-pxxj","aliases":["CGA-fh6w-prcg-pxxj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-discovery-ec2","purl":"pkg:apk/chainguard/opensearch-fips-3-discovery-ec2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fh6w-prcg-pxxj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:06Z"}]}}],"modified":"2026-10-03T10:31:15.423817273Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5c05da3a-ed38-44bd-a7c2-f9b5ebe8532b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fh6w-prcg-pxxj","advisory_id":"5c05da3a-ed38-44bd-a7c2-f9b5ebe8532b","event_types":["advisory"],"published_at":"2026-10-26T00:29:21.807962+00:00","technologies":["core-osv","opensearch-fips-3-discovery-ec2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:54:06+00:00","detail_url":"/advisories/advisory%3A5c05da3a-ed38-44bd-a7c2-f9b5ebe8532b","group":{"id":"advisory:5c05da3a-ed38-44bd-a7c2-f9b5ebe8532b","revision":1,"primary_event_id":73199,"change":"published","superseded_by":[],"changed":{"id":73199,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-fh6w-prcg-pxxj","summary":"CGA-fh6w-prcg-pxxj","evidence":"osv:CGA-fh6w-prcg-pxxj","products":[{"name":{"value":"opensearch-fips-3-discovery-ec2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fh6w-prcg-pxxj","aliases":["CGA-fh6w-prcg-pxxj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-discovery-ec2","purl":"pkg:apk/chainguard/opensearch-fips-3-discovery-ec2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fh6w-prcg-pxxj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:06Z"}]}}],"modified":"2026-10-03T10:31:15.423817273Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5c05da3a-ed38-44bd-a7c2-f9b5ebe8532b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fh6w-prcg-pxxj","advisory_id":"5c05da3a-ed38-44bd-a7c2-f9b5ebe8532b","event_types":["advisory"],"published_at":"2026-10-26T00:29:21.807962+00:00","technologies":["core-osv","opensearch-fips-3-discovery-ec2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:54:06+00:00","detail_url":"/events/73199"},"members":[{"id":73199,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-fh6w-prcg-pxxj","summary":"CGA-fh6w-prcg-pxxj","evidence":"osv:CGA-fh6w-prcg-pxxj","products":[{"name":{"value":"opensearch-fips-3-discovery-ec2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fh6w-prcg-pxxj","aliases":["CGA-fh6w-prcg-pxxj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-discovery-ec2","purl":"pkg:apk/chainguard/opensearch-fips-3-discovery-ec2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fh6w-prcg-pxxj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/share/opensearch/plugins/opensearch-discovery-ec2/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:04:06Z"}]}}],"modified":"2026-10-03T10:31:15.423817273Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5c05da3a-ed38-44bd-a7c2-f9b5ebe8532b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fh6w-prcg-pxxj","advisory_id":"5c05da3a-ed38-44bd-a7c2-f9b5ebe8532b","event_types":["advisory"],"published_at":"2026-10-26T00:29:21.807962+00:00","technologies":["core-osv","opensearch-fips-3-discovery-ec2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:54:06+00:00","detail_url":"/events/73199"}]}},{"id":72524,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-x9v2-m539-597r","summary":"CGA-x9v2-m539-597r","evidence":"osv:CGA-x9v2-m539-597r","products":[{"name":{"value":"celeborn-0.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"celeborn-0.6","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x9v2-m539-597r","aliases":["CGA-x9v2-m539-597r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/chainguard/celeborn-0.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x9v2-m539-597r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/wolfi/celeborn-0.6?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x9v2-m539-597r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}}],"modified":"2026-10-03T10:30:22.927288402Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5071c529-5546-44d5-8188-d6cfe8bc4003","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x9v2-m539-597r","advisory_id":"5071c529-5546-44d5-8188-d6cfe8bc4003","event_types":["advisory"],"published_at":"2026-10-26T00:28:06.868145+00:00","technologies":["celeborn-0-6","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:13:25+00:00","detail_url":"/advisories/advisory%3A5071c529-5546-44d5-8188-d6cfe8bc4003","group":{"id":"advisory:5071c529-5546-44d5-8188-d6cfe8bc4003","revision":1,"primary_event_id":73184,"change":"published","superseded_by":[],"changed":{"id":73184,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-x9v2-m539-597r","summary":"CGA-x9v2-m539-597r","evidence":"osv:CGA-x9v2-m539-597r","products":[{"name":{"value":"celeborn-0.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"celeborn-0.6","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x9v2-m539-597r","aliases":["CGA-x9v2-m539-597r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/chainguard/celeborn-0.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x9v2-m539-597r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/wolfi/celeborn-0.6?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x9v2-m539-597r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}}],"modified":"2026-10-03T10:30:22.927288402Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5071c529-5546-44d5-8188-d6cfe8bc4003","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x9v2-m539-597r","advisory_id":"5071c529-5546-44d5-8188-d6cfe8bc4003","event_types":["advisory"],"published_at":"2026-10-26T00:28:06.868145+00:00","technologies":["celeborn-0-6","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:13:25+00:00","detail_url":"/events/73184"},"members":[{"id":73184,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-x9v2-m539-597r","summary":"CGA-x9v2-m539-597r","evidence":"osv:CGA-x9v2-m539-597r","products":[{"name":{"value":"celeborn-0.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"celeborn-0.6","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.6.3-r19","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x9v2-m539-597r","aliases":["CGA-x9v2-m539-597r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/chainguard/celeborn-0.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x9v2-m539-597r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-r19"}]}],"package":{"name":"celeborn-0.6","purl":"pkg:apk/wolfi/celeborn-0.6?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x9v2-m539-597r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.10","component_type":"java-archive","component_version":"2.18.10","component_location":"/usr/share/java/celeborn/jars/jackson-databind-2.18.10.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:20:34Z"}]}}],"modified":"2026-10-03T10:30:22.927288402Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5071c529-5546-44d5-8188-d6cfe8bc4003","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x9v2-m539-597r","advisory_id":"5071c529-5546-44d5-8188-d6cfe8bc4003","event_types":["advisory"],"published_at":"2026-10-26T00:28:06.868145+00:00","technologies":["celeborn-0-6","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:13:25+00:00","detail_url":"/events/73184"}]}},{"id":72516,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-prm7-7577-m7w7","summary":"CGA-prm7-7577-m7w7","evidence":"osv:CGA-prm7-7577-m7w7","products":[{"name":{"value":"logstash-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"logstash-9.4","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-prm7-7577-m7w7","aliases":["CGA-prm7-7577-m7w7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/chainguard/logstash-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-prm7-7577-m7w7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.8-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.8/logstash-filter-elastic_integration-9.4.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/wolfi/logstash-9.4?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-prm7-7577-m7w7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.8-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.8/logstash-filter-elastic_integration-9.4.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}}],"modified":"2026-10-02T23:01:42.146548813Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:14abff5d-26bd-4955-acb9-03a689ccd3ff","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-prm7-7577-m7w7","advisory_id":"14abff5d-26bd-4955-acb9-03a689ccd3ff","event_types":["advisory"],"published_at":"2026-10-26T00:26:58.573921+00:00","technologies":["core-osv","logstash-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:09:28+00:00","detail_url":"/advisories/advisory%3A14abff5d-26bd-4955-acb9-03a689ccd3ff","group":{"id":"advisory:14abff5d-26bd-4955-acb9-03a689ccd3ff","revision":1,"primary_event_id":73172,"change":"published","superseded_by":[],"changed":{"id":73172,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-prm7-7577-m7w7","summary":"CGA-prm7-7577-m7w7","evidence":"osv:CGA-prm7-7577-m7w7","products":[{"name":{"value":"logstash-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"logstash-9.4","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-prm7-7577-m7w7","aliases":["CGA-prm7-7577-m7w7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/chainguard/logstash-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-prm7-7577-m7w7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.8-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.8/logstash-filter-elastic_integration-9.4.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/wolfi/logstash-9.4?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-prm7-7577-m7w7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.8-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.8/logstash-filter-elastic_integration-9.4.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}}],"modified":"2026-10-02T23:01:42.146548813Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:14abff5d-26bd-4955-acb9-03a689ccd3ff","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-prm7-7577-m7w7","advisory_id":"14abff5d-26bd-4955-acb9-03a689ccd3ff","event_types":["advisory"],"published_at":"2026-10-26T00:26:58.573921+00:00","technologies":["core-osv","logstash-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:09:28+00:00","detail_url":"/events/73172"},"members":[{"id":73172,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-prm7-7577-m7w7","summary":"CGA-prm7-7577-m7w7","evidence":"osv:CGA-prm7-7577-m7w7","products":[{"name":{"value":"logstash-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"logstash-9.4","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-prm7-7577-m7w7","aliases":["CGA-prm7-7577-m7w7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/chainguard/logstash-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-prm7-7577-m7w7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.8-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.8/logstash-filter-elastic_integration-9.4.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/wolfi/logstash-9.4?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-prm7-7577-m7w7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.8-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.8/logstash-filter-elastic_integration-9.4.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}}],"modified":"2026-10-02T23:01:42.146548813Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:14abff5d-26bd-4955-acb9-03a689ccd3ff","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-prm7-7577-m7w7","advisory_id":"14abff5d-26bd-4955-acb9-03a689ccd3ff","event_types":["advisory"],"published_at":"2026-10-26T00:26:58.573921+00:00","technologies":["core-osv","logstash-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:09:28+00:00","detail_url":"/events/73172"}]}},{"id":72508,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xc46-rwvp-v7jv","summary":"CGA-xc46-rwvp-v7jv","evidence":"osv:CGA-xc46-rwvp-v7jv","products":[{"name":{"value":"opensearch-3-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-sql","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xc46-rwvp-v7jv","aliases":["CGA-xc46-rwvp-v7jv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-sql","purl":"pkg:apk/chainguard/opensearch-3-sql?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xc46-rwvp-v7jv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-sql","purl":"pkg:apk/wolfi/opensearch-3-sql?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xc46-rwvp-v7jv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:07Z"}]}}],"modified":"2026-10-03T10:30:23.251938160Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:84542945-9d9e-4372-acb5-a372b756df84","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xc46-rwvp-v7jv","advisory_id":"84542945-9d9e-4372-acb5-a372b756df84","event_types":["advisory"],"published_at":"2026-10-26T00:26:06.116612+00:00","technologies":["core-osv","opensearch-3-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:34:42+00:00","detail_url":"/advisories/advisory%3A84542945-9d9e-4372-acb5-a372b756df84","group":{"id":"advisory:84542945-9d9e-4372-acb5-a372b756df84","revision":1,"primary_event_id":73162,"change":"published","superseded_by":[],"changed":{"id":73162,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xc46-rwvp-v7jv","summary":"CGA-xc46-rwvp-v7jv","evidence":"osv:CGA-xc46-rwvp-v7jv","products":[{"name":{"value":"opensearch-3-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-sql","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xc46-rwvp-v7jv","aliases":["CGA-xc46-rwvp-v7jv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-sql","purl":"pkg:apk/chainguard/opensearch-3-sql?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xc46-rwvp-v7jv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-sql","purl":"pkg:apk/wolfi/opensearch-3-sql?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xc46-rwvp-v7jv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:07Z"}]}}],"modified":"2026-10-03T10:30:23.251938160Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:84542945-9d9e-4372-acb5-a372b756df84","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xc46-rwvp-v7jv","advisory_id":"84542945-9d9e-4372-acb5-a372b756df84","event_types":["advisory"],"published_at":"2026-10-26T00:26:06.116612+00:00","technologies":["core-osv","opensearch-3-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:34:42+00:00","detail_url":"/events/73162"},"members":[{"id":73162,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xc46-rwvp-v7jv","summary":"CGA-xc46-rwvp-v7jv","evidence":"osv:CGA-xc46-rwvp-v7jv","products":[{"name":{"value":"opensearch-3-sql","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-sql","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xc46-rwvp-v7jv","aliases":["CGA-xc46-rwvp-v7jv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-sql","purl":"pkg:apk/chainguard/opensearch-3-sql?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xc46-rwvp-v7jv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-sql","purl":"pkg:apk/wolfi/opensearch-3-sql?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xc46-rwvp-v7jv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-sql/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:43:07Z"}]}}],"modified":"2026-10-03T10:30:23.251938160Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:84542945-9d9e-4372-acb5-a372b756df84","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xc46-rwvp-v7jv","advisory_id":"84542945-9d9e-4372-acb5-a372b756df84","event_types":["advisory"],"published_at":"2026-10-26T00:26:06.116612+00:00","technologies":["core-osv","opensearch-3-sql"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T01:34:42+00:00","detail_url":"/events/73162"}]}},{"id":72502,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xr4g-f236-q7v3","summary":"CGA-xr4g-f236-q7v3","evidence":"osv:CGA-xr4g-f236-q7v3","products":[{"name":{"value":"opensearch-3-alerting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-alerting","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xr4g-f236-q7v3","aliases":["CGA-xr4g-f236-q7v3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/chainguard/opensearch-3-alerting?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xr4g-f236-q7v3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:04:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/wolfi/opensearch-3-alerting?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xr4g-f236-q7v3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:04:07Z"}]}}],"modified":"2026-10-03T10:30:19.144455007Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e5728516-11d4-49e2-a728-d7c9c45be780","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xr4g-f236-q7v3","advisory_id":"e5728516-11d4-49e2-a728-d7c9c45be780","event_types":["advisory"],"published_at":"2026-10-26T00:25:15.665731+00:00","technologies":["core-osv","opensearch-3-alerting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:10:13+00:00","detail_url":"/advisories/advisory%3Ae5728516-11d4-49e2-a728-d7c9c45be780","group":{"id":"advisory:e5728516-11d4-49e2-a728-d7c9c45be780","revision":1,"primary_event_id":73151,"change":"published","superseded_by":[],"changed":{"id":73151,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xr4g-f236-q7v3","summary":"CGA-xr4g-f236-q7v3","evidence":"osv:CGA-xr4g-f236-q7v3","products":[{"name":{"value":"opensearch-3-alerting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-alerting","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xr4g-f236-q7v3","aliases":["CGA-xr4g-f236-q7v3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/chainguard/opensearch-3-alerting?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xr4g-f236-q7v3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:04:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/wolfi/opensearch-3-alerting?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xr4g-f236-q7v3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:04:07Z"}]}}],"modified":"2026-10-03T10:30:19.144455007Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e5728516-11d4-49e2-a728-d7c9c45be780","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xr4g-f236-q7v3","advisory_id":"e5728516-11d4-49e2-a728-d7c9c45be780","event_types":["advisory"],"published_at":"2026-10-26T00:25:15.665731+00:00","technologies":["core-osv","opensearch-3-alerting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:10:13+00:00","detail_url":"/events/73151"},"members":[{"id":73151,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xr4g-f236-q7v3","summary":"CGA-xr4g-f236-q7v3","evidence":"osv:CGA-xr4g-f236-q7v3","products":[{"name":{"value":"opensearch-3-alerting","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-3-alerting","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xr4g-f236-q7v3","aliases":["CGA-xr4g-f236-q7v3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/chainguard/opensearch-3-alerting?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xr4g-f236-q7v3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:04:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-3-alerting","purl":"pkg:apk/wolfi/opensearch-3-alerting?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xr4g-f236-q7v3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-alerting/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:04:07Z"}]}}],"modified":"2026-10-03T10:30:19.144455007Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e5728516-11d4-49e2-a728-d7c9c45be780","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xr4g-f236-q7v3","advisory_id":"e5728516-11d4-49e2-a728-d7c9c45be780","event_types":["advisory"],"published_at":"2026-10-26T00:25:15.665731+00:00","technologies":["core-osv","opensearch-3-alerting"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T02:10:13+00:00","detail_url":"/events/73151"}]}},{"id":72497,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-697g-xjjp-47x8","summary":"CGA-697g-xjjp-47x8","evidence":"osv:CGA-697g-xjjp-47x8","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-697g-xjjp-47x8","aliases":["CGA-697g-xjjp-47x8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-697g-xjjp-47x8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:49:50Z"}]}}],"modified":"2026-10-03T10:30:17.503496527Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0749946f-7ff3-4c6f-88a3-4f59346122f4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-697g-xjjp-47x8","advisory_id":"0749946f-7ff3-4c6f-88a3-4f59346122f4","event_types":["advisory"],"published_at":"2026-10-26T00:24:51.26415+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:18:42+00:00","detail_url":"/advisories/advisory%3A0749946f-7ff3-4c6f-88a3-4f59346122f4","group":{"id":"advisory:0749946f-7ff3-4c6f-88a3-4f59346122f4","revision":1,"primary_event_id":73146,"change":"published","superseded_by":[],"changed":{"id":73146,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-697g-xjjp-47x8","summary":"CGA-697g-xjjp-47x8","evidence":"osv:CGA-697g-xjjp-47x8","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-697g-xjjp-47x8","aliases":["CGA-697g-xjjp-47x8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-697g-xjjp-47x8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:49:50Z"}]}}],"modified":"2026-10-03T10:30:17.503496527Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0749946f-7ff3-4c6f-88a3-4f59346122f4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-697g-xjjp-47x8","advisory_id":"0749946f-7ff3-4c6f-88a3-4f59346122f4","event_types":["advisory"],"published_at":"2026-10-26T00:24:51.26415+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:18:42+00:00","detail_url":"/events/73146"},"members":[{"id":73146,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-697g-xjjp-47x8","summary":"CGA-697g-xjjp-47x8","evidence":"osv:CGA-697g-xjjp-47x8","products":[{"name":{"value":"opensearch-fips-3-notifications","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.9.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-697g-xjjp-47x8","aliases":["CGA-697g-xjjp-47x8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-r1"}]}],"package":{"name":"opensearch-fips-3-notifications","purl":"pkg:apk/chainguard/opensearch-fips-3-notifications?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-697g-xjjp-47x8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/opensearch/plugins/opensearch-notifications-core/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:49:50Z"}]}}],"modified":"2026-10-03T10:30:17.503496527Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0749946f-7ff3-4c6f-88a3-4f59346122f4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-697g-xjjp-47x8","advisory_id":"0749946f-7ff3-4c6f-88a3-4f59346122f4","event_types":["advisory"],"published_at":"2026-10-26T00:24:51.26415+00:00","technologies":["core-osv","opensearch-fips-3-notifications"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T00:18:42+00:00","detail_url":"/events/73146"}]}},{"id":72267,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xj23-qgrw-2hjq","summary":"CGA-xj23-qgrw-2hjq","evidence":"osv:CGA-xj23-qgrw-2hjq","products":[{"name":{"value":"neo4j-2026.07","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.07.1-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"neo4j-2026.07","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.07.1-r5","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xj23-qgrw-2hjq","aliases":["CGA-xj23-qgrw-2hjq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.07.1-r5"}]}],"package":{"name":"neo4j-2026.07","purl":"pkg:apk/chainguard/neo4j-2026.07?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xj23-qgrw-2hjq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/var/lib/neo4j/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:02:03Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.07.1-r5"}]}],"package":{"name":"neo4j-2026.07","purl":"pkg:apk/wolfi/neo4j-2026.07?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xj23-qgrw-2hjq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/var/lib/neo4j/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:02:03Z"}]}}],"modified":"2026-10-02T23:01:55.629599921Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bd2943cb-758c-45e5-8f2e-8187ae1809d5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xj23-qgrw-2hjq","advisory_id":"bd2943cb-758c-45e5-8f2e-8187ae1809d5","event_types":["advisory"],"published_at":"2026-10-26T00:19:47.276825+00:00","technologies":["core-osv","neo4j-2026-07"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:31:08+00:00","detail_url":"/advisories/advisory%3Abd2943cb-758c-45e5-8f2e-8187ae1809d5","group":{"id":"advisory:bd2943cb-758c-45e5-8f2e-8187ae1809d5","revision":1,"primary_event_id":72912,"change":"published","superseded_by":[],"changed":{"id":72912,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xj23-qgrw-2hjq","summary":"CGA-xj23-qgrw-2hjq","evidence":"osv:CGA-xj23-qgrw-2hjq","products":[{"name":{"value":"neo4j-2026.07","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.07.1-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"neo4j-2026.07","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.07.1-r5","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xj23-qgrw-2hjq","aliases":["CGA-xj23-qgrw-2hjq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.07.1-r5"}]}],"package":{"name":"neo4j-2026.07","purl":"pkg:apk/chainguard/neo4j-2026.07?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xj23-qgrw-2hjq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/var/lib/neo4j/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:02:03Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.07.1-r5"}]}],"package":{"name":"neo4j-2026.07","purl":"pkg:apk/wolfi/neo4j-2026.07?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xj23-qgrw-2hjq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/var/lib/neo4j/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:02:03Z"}]}}],"modified":"2026-10-02T23:01:55.629599921Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bd2943cb-758c-45e5-8f2e-8187ae1809d5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xj23-qgrw-2hjq","advisory_id":"bd2943cb-758c-45e5-8f2e-8187ae1809d5","event_types":["advisory"],"published_at":"2026-10-26T00:19:47.276825+00:00","technologies":["core-osv","neo4j-2026-07"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:31:08+00:00","detail_url":"/events/72912"},"members":[{"id":72912,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xj23-qgrw-2hjq","summary":"CGA-xj23-qgrw-2hjq","evidence":"osv:CGA-xj23-qgrw-2hjq","products":[{"name":{"value":"neo4j-2026.07","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.07.1-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"neo4j-2026.07","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.07.1-r5","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xj23-qgrw-2hjq","aliases":["CGA-xj23-qgrw-2hjq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.07.1-r5"}]}],"package":{"name":"neo4j-2026.07","purl":"pkg:apk/chainguard/neo4j-2026.07?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xj23-qgrw-2hjq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/var/lib/neo4j/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:02:03Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.07.1-r5"}]}],"package":{"name":"neo4j-2026.07","purl":"pkg:apk/wolfi/neo4j-2026.07?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xj23-qgrw-2hjq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/var/lib/neo4j/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:02:03Z"}]}}],"modified":"2026-10-02T23:01:55.629599921Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bd2943cb-758c-45e5-8f2e-8187ae1809d5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xj23-qgrw-2hjq","advisory_id":"bd2943cb-758c-45e5-8f2e-8187ae1809d5","event_types":["advisory"],"published_at":"2026-10-26T00:19:47.276825+00:00","technologies":["core-osv","neo4j-2026-07"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:31:08+00:00","detail_url":"/events/72912"}]}},{"id":72158,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-v7wh-xrg3-3prp","summary":"CGA-v7wh-xrg3-3prp","evidence":"osv:CGA-v7wh-xrg3-3prp","products":[{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v7wh-xrg3-3prp","aliases":["CGA-v7wh-xrg3-3prp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7wh-xrg3-3prp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-server-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7wh-xrg3-3prp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-server-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}}],"modified":"2026-10-02T23:01:47.870648270Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5bf30b9e-9727-45a2-a475-bd7d2a8f76cc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v7wh-xrg3-3prp","advisory_id":"5bf30b9e-9727-45a2-a475-bd7d2a8f76cc","event_types":["advisory"],"published_at":"2026-10-26T00:17:58.323775+00:00","technologies":["core-osv","management-api-for-apache-cassandra-5-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:11:05+00:00","detail_url":"/advisories/advisory%3A5bf30b9e-9727-45a2-a475-bd7d2a8f76cc","group":{"id":"advisory:5bf30b9e-9727-45a2-a475-bd7d2a8f76cc","revision":1,"primary_event_id":72796,"change":"published","superseded_by":[],"changed":{"id":72796,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-v7wh-xrg3-3prp","summary":"CGA-v7wh-xrg3-3prp","evidence":"osv:CGA-v7wh-xrg3-3prp","products":[{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v7wh-xrg3-3prp","aliases":["CGA-v7wh-xrg3-3prp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7wh-xrg3-3prp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-server-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7wh-xrg3-3prp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-server-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}}],"modified":"2026-10-02T23:01:47.870648270Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5bf30b9e-9727-45a2-a475-bd7d2a8f76cc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v7wh-xrg3-3prp","advisory_id":"5bf30b9e-9727-45a2-a475-bd7d2a8f76cc","event_types":["advisory"],"published_at":"2026-10-26T00:17:58.323775+00:00","technologies":["core-osv","management-api-for-apache-cassandra-5-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:11:05+00:00","detail_url":"/events/72796"},"members":[{"id":72796,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-v7wh-xrg3-3prp","summary":"CGA-v7wh-xrg3-3prp","evidence":"osv:CGA-v7wh-xrg3-3prp","products":[{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v7wh-xrg3-3prp","aliases":["CGA-v7wh-xrg3-3prp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7wh-xrg3-3prp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-server-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7wh-xrg3-3prp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-server-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}}],"modified":"2026-10-02T23:01:47.870648270Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5bf30b9e-9727-45a2-a475-bd7d2a8f76cc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v7wh-xrg3-3prp","advisory_id":"5bf30b9e-9727-45a2-a475-bd7d2a8f76cc","event_types":["advisory"],"published_at":"2026-10-26T00:17:58.323775+00:00","technologies":["core-osv","management-api-for-apache-cassandra-5-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:11:05+00:00","detail_url":"/events/72796"}]}},{"id":72083,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xvvq-4552-2fp9","summary":"CGA-xvvq-4552-2fp9","evidence":"osv:CGA-xvvq-4552-2fp9","products":[{"name":{"value":"airbyte-platform-fips-bootloader","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.0-r10","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xvvq-4552-2fp9","aliases":["CGA-xvvq-4552-2fp9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-r10"}]}],"package":{"name":"airbyte-platform-fips-bootloader","purl":"pkg:apk/chainguard/airbyte-platform-fips-bootloader?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xvvq-4552-2fp9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/airbyte-platform-fips-bootloader/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:22:07Z"}]}}],"modified":"2026-10-02T23:01:55.779785053Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f2413e2-01d3-4d9a-9336-6a83850e3a4b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xvvq-4552-2fp9","advisory_id":"6f2413e2-01d3-4d9a-9336-6a83850e3a4b","event_types":["advisory"],"published_at":"2026-10-26T00:16:20.506428+00:00","technologies":["airbyte-platform-fips-bootloader","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:40:36+00:00","detail_url":"/advisories/advisory%3A6f2413e2-01d3-4d9a-9336-6a83850e3a4b","group":{"id":"advisory:6f2413e2-01d3-4d9a-9336-6a83850e3a4b","revision":1,"primary_event_id":72714,"change":"published","superseded_by":[],"changed":{"id":72714,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xvvq-4552-2fp9","summary":"CGA-xvvq-4552-2fp9","evidence":"osv:CGA-xvvq-4552-2fp9","products":[{"name":{"value":"airbyte-platform-fips-bootloader","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.0-r10","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xvvq-4552-2fp9","aliases":["CGA-xvvq-4552-2fp9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-r10"}]}],"package":{"name":"airbyte-platform-fips-bootloader","purl":"pkg:apk/chainguard/airbyte-platform-fips-bootloader?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xvvq-4552-2fp9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/airbyte-platform-fips-bootloader/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:22:07Z"}]}}],"modified":"2026-10-02T23:01:55.779785053Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f2413e2-01d3-4d9a-9336-6a83850e3a4b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xvvq-4552-2fp9","advisory_id":"6f2413e2-01d3-4d9a-9336-6a83850e3a4b","event_types":["advisory"],"published_at":"2026-10-26T00:16:20.506428+00:00","technologies":["airbyte-platform-fips-bootloader","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:40:36+00:00","detail_url":"/events/72714"},"members":[{"id":72714,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xvvq-4552-2fp9","summary":"CGA-xvvq-4552-2fp9","evidence":"osv:CGA-xvvq-4552-2fp9","products":[{"name":{"value":"airbyte-platform-fips-bootloader","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.0-r10","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xvvq-4552-2fp9","aliases":["CGA-xvvq-4552-2fp9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-r10"}]}],"package":{"name":"airbyte-platform-fips-bootloader","purl":"pkg:apk/chainguard/airbyte-platform-fips-bootloader?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xvvq-4552-2fp9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/airbyte-platform-fips-bootloader/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:22:07Z"}]}}],"modified":"2026-10-02T23:01:55.779785053Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f2413e2-01d3-4d9a-9336-6a83850e3a4b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xvvq-4552-2fp9","advisory_id":"6f2413e2-01d3-4d9a-9336-6a83850e3a4b","event_types":["advisory"],"published_at":"2026-10-26T00:16:20.506428+00:00","technologies":["airbyte-platform-fips-bootloader","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:40:36+00:00","detail_url":"/events/72714"}]}},{"id":72076,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xqr2-6wq3-m88x","summary":"CGA-xqr2-6wq3-m88x","evidence":"osv:CGA-xqr2-6wq3-m88x","products":[{"name":{"value":"logstash-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"logstash-9.4","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xqr2-6wq3-m88x","aliases":["CGA-xqr2-6wq3-m88x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/chainguard/logstash-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqr2-6wq3-m88x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/wolfi/logstash-9.4?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqr2-6wq3-m88x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}}],"modified":"2026-10-02T23:01:52.135844151Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e27b3f34-6a6d-4b9a-8e33-bf4a2c69006a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqr2-6wq3-m88x","advisory_id":"e27b3f34-6a6d-4b9a-8e33-bf4a2c69006a","event_types":["advisory"],"published_at":"2026-10-26T00:15:55.336802+00:00","technologies":["core-osv","logstash-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:09:29+00:00","detail_url":"/advisories/advisory%3Ae27b3f34-6a6d-4b9a-8e33-bf4a2c69006a","group":{"id":"advisory:e27b3f34-6a6d-4b9a-8e33-bf4a2c69006a","revision":1,"primary_event_id":72707,"change":"published","superseded_by":[],"changed":{"id":72707,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xqr2-6wq3-m88x","summary":"CGA-xqr2-6wq3-m88x","evidence":"osv:CGA-xqr2-6wq3-m88x","products":[{"name":{"value":"logstash-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"logstash-9.4","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xqr2-6wq3-m88x","aliases":["CGA-xqr2-6wq3-m88x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/chainguard/logstash-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqr2-6wq3-m88x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/wolfi/logstash-9.4?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqr2-6wq3-m88x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}}],"modified":"2026-10-02T23:01:52.135844151Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e27b3f34-6a6d-4b9a-8e33-bf4a2c69006a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqr2-6wq3-m88x","advisory_id":"e27b3f34-6a6d-4b9a-8e33-bf4a2c69006a","event_types":["advisory"],"published_at":"2026-10-26T00:15:55.336802+00:00","technologies":["core-osv","logstash-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:09:29+00:00","detail_url":"/events/72707"},"members":[{"id":72707,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xqr2-6wq3-m88x","summary":"CGA-xqr2-6wq3-m88x","evidence":"osv:CGA-xqr2-6wq3-m88x","products":[{"name":{"value":"logstash-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"logstash-9.4","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xqr2-6wq3-m88x","aliases":["CGA-xqr2-6wq3-m88x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/chainguard/logstash-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqr2-6wq3-m88x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"logstash-9.4","purl":"pkg:apk/wolfi/logstash-9.4?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqr2-6wq3-m88x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:12Z"}]}}],"modified":"2026-10-02T23:01:52.135844151Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e27b3f34-6a6d-4b9a-8e33-bf4a2c69006a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqr2-6wq3-m88x","advisory_id":"e27b3f34-6a6d-4b9a-8e33-bf4a2c69006a","event_types":["advisory"],"published_at":"2026-10-26T00:15:55.336802+00:00","technologies":["core-osv","logstash-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:09:29+00:00","detail_url":"/events/72707"}]}},{"id":72075,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xpf4-hvxm-wg5f","summary":"CGA-xpf4-hvxm-wg5f","evidence":"osv:CGA-xpf4-hvxm-wg5f","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xpf4-hvxm-wg5f","aliases":["CGA-xpf4-hvxm-wg5f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xpf4-hvxm-wg5f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:48:08Z"}]}}],"modified":"2026-10-02T23:01:52.130856138Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1e0af62b-f41b-4a01-81e3-15a1103f8308","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xpf4-hvxm-wg5f","advisory_id":"1e0af62b-f41b-4a01-81e3-15a1103f8308","event_types":["advisory"],"published_at":"2026-10-26T00:15:47.023467+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:23:56+00:00","detail_url":"/advisories/advisory%3A1e0af62b-f41b-4a01-81e3-15a1103f8308","group":{"id":"advisory:1e0af62b-f41b-4a01-81e3-15a1103f8308","revision":1,"primary_event_id":72706,"change":"published","superseded_by":[],"changed":{"id":72706,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xpf4-hvxm-wg5f","summary":"CGA-xpf4-hvxm-wg5f","evidence":"osv:CGA-xpf4-hvxm-wg5f","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xpf4-hvxm-wg5f","aliases":["CGA-xpf4-hvxm-wg5f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xpf4-hvxm-wg5f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:48:08Z"}]}}],"modified":"2026-10-02T23:01:52.130856138Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1e0af62b-f41b-4a01-81e3-15a1103f8308","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xpf4-hvxm-wg5f","advisory_id":"1e0af62b-f41b-4a01-81e3-15a1103f8308","event_types":["advisory"],"published_at":"2026-10-26T00:15:47.023467+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:23:56+00:00","detail_url":"/events/72706"},"members":[{"id":72706,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-xpf4-hvxm-wg5f","summary":"CGA-xpf4-hvxm-wg5f","evidence":"osv:CGA-xpf4-hvxm-wg5f","products":[{"name":{"value":"logstash-9.5-iamguarded-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xpf4-hvxm-wg5f","aliases":["CGA-xpf4-hvxm-wg5f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5-iamguarded-compat","purl":"pkg:apk/chainguard/logstash-9.5-iamguarded-compat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xpf4-hvxm-wg5f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/opt/iamguarded/logstash/logstash-core/lib/jars/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:48:08Z"}]}}],"modified":"2026-10-02T23:01:52.130856138Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1e0af62b-f41b-4a01-81e3-15a1103f8308","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xpf4-hvxm-wg5f","advisory_id":"1e0af62b-f41b-4a01-81e3-15a1103f8308","event_types":["advisory"],"published_at":"2026-10-26T00:15:47.023467+00:00","technologies":["core-osv","logstash-9-5-iamguarded-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:23:56+00:00","detail_url":"/events/72706"}]}},{"id":72073,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-wh94-2vqx-q7m4","summary":"CGA-wh94-2vqx-q7m4","evidence":"osv:CGA-wh94-2vqx-q7m4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wh94-2vqx-q7m4","aliases":["CGA-wh94-2vqx-q7m4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh94-2vqx-q7m4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:10Z"}]}}],"modified":"2026-10-02T23:01:51.515598774Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:46cb30f0-1093-42d7-880e-8f4def39e827","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh94-2vqx-q7m4","advisory_id":"46cb30f0-1093-42d7-880e-8f4def39e827","event_types":["advisory"],"published_at":"2026-10-26T00:15:19.764429+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:17+00:00","detail_url":"/advisories/advisory%3A46cb30f0-1093-42d7-880e-8f4def39e827","group":{"id":"advisory:46cb30f0-1093-42d7-880e-8f4def39e827","revision":1,"primary_event_id":72702,"change":"published","superseded_by":[],"changed":{"id":72702,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-wh94-2vqx-q7m4","summary":"CGA-wh94-2vqx-q7m4","evidence":"osv:CGA-wh94-2vqx-q7m4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wh94-2vqx-q7m4","aliases":["CGA-wh94-2vqx-q7m4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh94-2vqx-q7m4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:10Z"}]}}],"modified":"2026-10-02T23:01:51.515598774Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:46cb30f0-1093-42d7-880e-8f4def39e827","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh94-2vqx-q7m4","advisory_id":"46cb30f0-1093-42d7-880e-8f4def39e827","event_types":["advisory"],"published_at":"2026-10-26T00:15:19.764429+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:17+00:00","detail_url":"/events/72702"},"members":[{"id":72702,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-wh94-2vqx-q7m4","summary":"CGA-wh94-2vqx-q7m4","evidence":"osv:CGA-wh94-2vqx-q7m4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wh94-2vqx-q7m4","aliases":["CGA-wh94-2vqx-q7m4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh94-2vqx-q7m4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:10Z"}]}}],"modified":"2026-10-02T23:01:51.515598774Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:46cb30f0-1093-42d7-880e-8f4def39e827","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh94-2vqx-q7m4","advisory_id":"46cb30f0-1093-42d7-880e-8f4def39e827","event_types":["advisory"],"published_at":"2026-10-26T00:15:19.764429+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:17+00:00","detail_url":"/events/72702"}]}},{"id":72071,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-wfc4-2rcw-9x2q","summary":"CGA-wfc4-2rcw-9x2q","evidence":"osv:CGA-wfc4-2rcw-9x2q","products":[{"name":{"value":"knative-kafka-broker-1.21-receiver-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.5-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wfc4-2rcw-9x2q","aliases":["CGA-wfc4-2rcw-9x2q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-r6"}]}],"package":{"name":"knative-kafka-broker-1.21-receiver-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-1.21-receiver-loom?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wfc4-2rcw-9x2q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/app/libs/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:08:07Z"}]}}],"modified":"2026-10-02T23:01:50.875555634Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0a0c33ee-e415-4045-bf01-80e11948e149","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wfc4-2rcw-9x2q","advisory_id":"0a0c33ee-e415-4045-bf01-80e11948e149","event_types":["advisory"],"published_at":"2026-10-26T00:15:07.911396+00:00","technologies":["core-osv","knative-kafka-broker-1-21-receiver-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:24:07+00:00","detail_url":"/advisories/advisory%3A0a0c33ee-e415-4045-bf01-80e11948e149","group":{"id":"advisory:0a0c33ee-e415-4045-bf01-80e11948e149","revision":1,"primary_event_id":72700,"change":"published","superseded_by":[],"changed":{"id":72700,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-wfc4-2rcw-9x2q","summary":"CGA-wfc4-2rcw-9x2q","evidence":"osv:CGA-wfc4-2rcw-9x2q","products":[{"name":{"value":"knative-kafka-broker-1.21-receiver-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.5-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wfc4-2rcw-9x2q","aliases":["CGA-wfc4-2rcw-9x2q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-r6"}]}],"package":{"name":"knative-kafka-broker-1.21-receiver-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-1.21-receiver-loom?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wfc4-2rcw-9x2q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/app/libs/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:08:07Z"}]}}],"modified":"2026-10-02T23:01:50.875555634Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0a0c33ee-e415-4045-bf01-80e11948e149","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wfc4-2rcw-9x2q","advisory_id":"0a0c33ee-e415-4045-bf01-80e11948e149","event_types":["advisory"],"published_at":"2026-10-26T00:15:07.911396+00:00","technologies":["core-osv","knative-kafka-broker-1-21-receiver-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:24:07+00:00","detail_url":"/events/72700"},"members":[{"id":72700,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-wfc4-2rcw-9x2q","summary":"CGA-wfc4-2rcw-9x2q","evidence":"osv:CGA-wfc4-2rcw-9x2q","products":[{"name":{"value":"knative-kafka-broker-1.21-receiver-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.5-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wfc4-2rcw-9x2q","aliases":["CGA-wfc4-2rcw-9x2q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-r6"}]}],"package":{"name":"knative-kafka-broker-1.21-receiver-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-1.21-receiver-loom?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wfc4-2rcw-9x2q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/app/libs/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:08:07Z"}]}}],"modified":"2026-10-02T23:01:50.875555634Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0a0c33ee-e415-4045-bf01-80e11948e149","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wfc4-2rcw-9x2q","advisory_id":"0a0c33ee-e415-4045-bf01-80e11948e149","event_types":["advisory"],"published_at":"2026-10-26T00:15:07.911396+00:00","technologies":["core-osv","knative-kafka-broker-1-21-receiver-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:24:07+00:00","detail_url":"/events/72700"}]}},{"id":72048,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-x768-h83m-qm5x","summary":"CGA-x768-h83m-qm5x","evidence":"osv:CGA-x768-h83m-qm5x","products":[{"name":{"value":"elasticsearch-8.19-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x768-h83m-qm5x","aliases":["CGA-x768-h83m-qm5x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-8.19-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-8.19-iamguarded-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x768-h83m-qm5x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/opt/iamguarded/elasticsearch/modules/x-pack-esql/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:33:04Z"}]}}],"modified":"2026-10-02T23:01:54.765000234Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b9c92566-c95c-4143-8f65-8183ff7ba1bb","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x768-h83m-qm5x","advisory_id":"b9c92566-c95c-4143-8f65-8183ff7ba1bb","event_types":["advisory"],"published_at":"2026-10-26T00:13:14.091713+00:00","technologies":["core-osv","elasticsearch-8-19-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:15:00+00:00","detail_url":"/advisories/advisory%3Ab9c92566-c95c-4143-8f65-8183ff7ba1bb","group":{"id":"advisory:b9c92566-c95c-4143-8f65-8183ff7ba1bb","revision":1,"primary_event_id":72671,"change":"published","superseded_by":[],"changed":{"id":72671,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-x768-h83m-qm5x","summary":"CGA-x768-h83m-qm5x","evidence":"osv:CGA-x768-h83m-qm5x","products":[{"name":{"value":"elasticsearch-8.19-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x768-h83m-qm5x","aliases":["CGA-x768-h83m-qm5x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-8.19-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-8.19-iamguarded-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x768-h83m-qm5x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/opt/iamguarded/elasticsearch/modules/x-pack-esql/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:33:04Z"}]}}],"modified":"2026-10-02T23:01:54.765000234Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b9c92566-c95c-4143-8f65-8183ff7ba1bb","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x768-h83m-qm5x","advisory_id":"b9c92566-c95c-4143-8f65-8183ff7ba1bb","event_types":["advisory"],"published_at":"2026-10-26T00:13:14.091713+00:00","technologies":["core-osv","elasticsearch-8-19-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:15:00+00:00","detail_url":"/events/72671"},"members":[{"id":72671,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-x768-h83m-qm5x","summary":"CGA-x768-h83m-qm5x","evidence":"osv:CGA-x768-h83m-qm5x","products":[{"name":{"value":"elasticsearch-8.19-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x768-h83m-qm5x","aliases":["CGA-x768-h83m-qm5x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-8.19-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-8.19-iamguarded-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x768-h83m-qm5x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/opt/iamguarded/elasticsearch/modules/x-pack-esql/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:33:04Z"}]}}],"modified":"2026-10-02T23:01:54.765000234Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b9c92566-c95c-4143-8f65-8183ff7ba1bb","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x768-h83m-qm5x","advisory_id":"b9c92566-c95c-4143-8f65-8183ff7ba1bb","event_types":["advisory"],"published_at":"2026-10-26T00:13:14.091713+00:00","technologies":["core-osv","elasticsearch-8-19-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:15:00+00:00","detail_url":"/events/72671"}]}},{"id":72047,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-q8f5-xr27-vwxj","summary":"CGA-q8f5-xr27-vwxj","evidence":"osv:CGA-q8f5-xr27-vwxj","products":[{"name":{"value":"strimzi-kafka-operator-fips-user-operator","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.2.0-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-q8f5-xr27-vwxj","aliases":["CGA-q8f5-xr27-vwxj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r6"}]}],"package":{"name":"strimzi-kafka-operator-fips-user-operator","purl":"pkg:apk/chainguard/strimzi-kafka-operator-fips-user-operator?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q8f5-xr27-vwxj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/opt/strimzi/lib/com.fasterxml.jackson.core.jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:00:26Z"}]}}],"modified":"2026-10-02T23:01:44.246430420Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1b8b3236-e2e1-4e12-b44e-fca656086a66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q8f5-xr27-vwxj","advisory_id":"1b8b3236-e2e1-4e12-b44e-fca656086a66","event_types":["advisory"],"published_at":"2026-10-26T00:13:05.808866+00:00","technologies":["core-osv","strimzi-kafka-operator-fips-user-operator"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:59+00:00","detail_url":"/advisories/advisory%3A1b8b3236-e2e1-4e12-b44e-fca656086a66","group":{"id":"advisory:1b8b3236-e2e1-4e12-b44e-fca656086a66","revision":1,"primary_event_id":72670,"change":"published","superseded_by":[],"changed":{"id":72670,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-q8f5-xr27-vwxj","summary":"CGA-q8f5-xr27-vwxj","evidence":"osv:CGA-q8f5-xr27-vwxj","products":[{"name":{"value":"strimzi-kafka-operator-fips-user-operator","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.2.0-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-q8f5-xr27-vwxj","aliases":["CGA-q8f5-xr27-vwxj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r6"}]}],"package":{"name":"strimzi-kafka-operator-fips-user-operator","purl":"pkg:apk/chainguard/strimzi-kafka-operator-fips-user-operator?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q8f5-xr27-vwxj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/opt/strimzi/lib/com.fasterxml.jackson.core.jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:00:26Z"}]}}],"modified":"2026-10-02T23:01:44.246430420Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1b8b3236-e2e1-4e12-b44e-fca656086a66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q8f5-xr27-vwxj","advisory_id":"1b8b3236-e2e1-4e12-b44e-fca656086a66","event_types":["advisory"],"published_at":"2026-10-26T00:13:05.808866+00:00","technologies":["core-osv","strimzi-kafka-operator-fips-user-operator"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:59+00:00","detail_url":"/events/72670"},"members":[{"id":72670,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-q8f5-xr27-vwxj","summary":"CGA-q8f5-xr27-vwxj","evidence":"osv:CGA-q8f5-xr27-vwxj","products":[{"name":{"value":"strimzi-kafka-operator-fips-user-operator","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.2.0-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-q8f5-xr27-vwxj","aliases":["CGA-q8f5-xr27-vwxj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r6"}]}],"package":{"name":"strimzi-kafka-operator-fips-user-operator","purl":"pkg:apk/chainguard/strimzi-kafka-operator-fips-user-operator?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q8f5-xr27-vwxj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/opt/strimzi/lib/com.fasterxml.jackson.core.jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:00:26Z"}]}}],"modified":"2026-10-02T23:01:44.246430420Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1b8b3236-e2e1-4e12-b44e-fca656086a66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q8f5-xr27-vwxj","advisory_id":"1b8b3236-e2e1-4e12-b44e-fca656086a66","event_types":["advisory"],"published_at":"2026-10-26T00:13:05.808866+00:00","technologies":["core-osv","strimzi-kafka-operator-fips-user-operator"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:59+00:00","detail_url":"/events/72670"}]}}],"next_after":72727,"next_before":72047}