{"schema_version":"2","view":"grouped","data":[{"id":72058,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-xrv3-29m9-whhx","summary":"CGA-xrv3-29m9-whhx","evidence":"osv:CGA-xrv3-29m9-whhx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xrv3-29m9-whhx","aliases":["CGA-xrv3-29m9-whhx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xrv3-29m9-whhx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:49Z"}]}}],"modified":"2026-10-02T23:01:56.332859318Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2fc5b9ea-d474-4170-8b5b-45149dd5373d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xrv3-29m9-whhx","advisory_id":"2fc5b9ea-d474-4170-8b5b-45149dd5373d","event_types":["advisory"],"published_at":"2026-10-26T00:14:22.193991+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:41+00:00","detail_url":"/advisories/advisory%3A2fc5b9ea-d474-4170-8b5b-45149dd5373d","group":{"id":"advisory:2fc5b9ea-d474-4170-8b5b-45149dd5373d","revision":1,"primary_event_id":72684,"change":"published","superseded_by":[],"changed":{"id":72684,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-xrv3-29m9-whhx","summary":"CGA-xrv3-29m9-whhx","evidence":"osv:CGA-xrv3-29m9-whhx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xrv3-29m9-whhx","aliases":["CGA-xrv3-29m9-whhx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xrv3-29m9-whhx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:49Z"}]}}],"modified":"2026-10-02T23:01:56.332859318Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2fc5b9ea-d474-4170-8b5b-45149dd5373d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xrv3-29m9-whhx","advisory_id":"2fc5b9ea-d474-4170-8b5b-45149dd5373d","event_types":["advisory"],"published_at":"2026-10-26T00:14:22.193991+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:41+00:00","detail_url":"/events/72684"},"members":[{"id":72684,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-xrv3-29m9-whhx","summary":"CGA-xrv3-29m9-whhx","evidence":"osv:CGA-xrv3-29m9-whhx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xrv3-29m9-whhx","aliases":["CGA-xrv3-29m9-whhx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xrv3-29m9-whhx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:49Z"}]}}],"modified":"2026-10-02T23:01:56.332859318Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2fc5b9ea-d474-4170-8b5b-45149dd5373d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xrv3-29m9-whhx","advisory_id":"2fc5b9ea-d474-4170-8b5b-45149dd5373d","event_types":["advisory"],"published_at":"2026-10-26T00:14:22.193991+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:41+00:00","detail_url":"/events/72684"}]}},{"id":71955,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-v393-qcqr-6jfr","summary":"CGA-v393-qcqr-6jfr","evidence":"osv:CGA-v393-qcqr-6jfr","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-v393-qcqr-6jfr","aliases":["CGA-v393-qcqr-6jfr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v393-qcqr-6jfr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:43Z"}]}}],"modified":"2026-10-02T23:01:45.152181765Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d058930a-8c74-4cd3-b208-449fee69b9df","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v393-qcqr-6jfr","advisory_id":"d058930a-8c74-4cd3-b208-449fee69b9df","event_types":["advisory"],"published_at":"2026-10-25T23:59:47.350453+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:42+00:00","detail_url":"/advisories/advisory%3Ad058930a-8c74-4cd3-b208-449fee69b9df","group":{"id":"advisory:d058930a-8c74-4cd3-b208-449fee69b9df","revision":1,"primary_event_id":72514,"change":"published","superseded_by":[],"changed":{"id":72514,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-v393-qcqr-6jfr","summary":"CGA-v393-qcqr-6jfr","evidence":"osv:CGA-v393-qcqr-6jfr","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-v393-qcqr-6jfr","aliases":["CGA-v393-qcqr-6jfr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v393-qcqr-6jfr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:43Z"}]}}],"modified":"2026-10-02T23:01:45.152181765Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d058930a-8c74-4cd3-b208-449fee69b9df","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v393-qcqr-6jfr","advisory_id":"d058930a-8c74-4cd3-b208-449fee69b9df","event_types":["advisory"],"published_at":"2026-10-25T23:59:47.350453+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:42+00:00","detail_url":"/events/72514"},"members":[{"id":72514,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-v393-qcqr-6jfr","summary":"CGA-v393-qcqr-6jfr","evidence":"osv:CGA-v393-qcqr-6jfr","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-v393-qcqr-6jfr","aliases":["CGA-v393-qcqr-6jfr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v393-qcqr-6jfr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:43Z"}]}}],"modified":"2026-10-02T23:01:45.152181765Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d058930a-8c74-4cd3-b208-449fee69b9df","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v393-qcqr-6jfr","advisory_id":"d058930a-8c74-4cd3-b208-449fee69b9df","event_types":["advisory"],"published_at":"2026-10-25T23:59:47.350453+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:42+00:00","detail_url":"/events/72514"}]}},{"id":71951,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-qg6v-53xr-vw24","summary":"CGA-qg6v-53xr-vw24","evidence":"osv:CGA-qg6v-53xr-vw24","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-qg6v-53xr-vw24","aliases":["CGA-qg6v-53xr-vw24"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qg6v-53xr-vw24.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:44.346805052Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d656ad99-cbfd-4114-89d3-f1b42fe72316","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qg6v-53xr-vw24","advisory_id":"d656ad99-cbfd-4114-89d3-f1b42fe72316","event_types":["advisory"],"published_at":"2026-10-25T23:59:11.102528+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/advisories/advisory%3Ad656ad99-cbfd-4114-89d3-f1b42fe72316","group":{"id":"advisory:d656ad99-cbfd-4114-89d3-f1b42fe72316","revision":1,"primary_event_id":72505,"change":"published","superseded_by":[],"changed":{"id":72505,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-qg6v-53xr-vw24","summary":"CGA-qg6v-53xr-vw24","evidence":"osv:CGA-qg6v-53xr-vw24","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-qg6v-53xr-vw24","aliases":["CGA-qg6v-53xr-vw24"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qg6v-53xr-vw24.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:44.346805052Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d656ad99-cbfd-4114-89d3-f1b42fe72316","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qg6v-53xr-vw24","advisory_id":"d656ad99-cbfd-4114-89d3-f1b42fe72316","event_types":["advisory"],"published_at":"2026-10-25T23:59:11.102528+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/events/72505"},"members":[{"id":72505,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-qg6v-53xr-vw24","summary":"CGA-qg6v-53xr-vw24","evidence":"osv:CGA-qg6v-53xr-vw24","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-qg6v-53xr-vw24","aliases":["CGA-qg6v-53xr-vw24"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qg6v-53xr-vw24.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:44.346805052Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d656ad99-cbfd-4114-89d3-f1b42fe72316","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qg6v-53xr-vw24","advisory_id":"d656ad99-cbfd-4114-89d3-f1b42fe72316","event_types":["advisory"],"published_at":"2026-10-25T23:59:11.102528+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/events/72505"}]}},{"id":71950,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-q4v3-hcr8-p922","summary":"CGA-q4v3-hcr8-p922","evidence":"osv:CGA-q4v3-hcr8-p922","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-q4v3-hcr8-p922","aliases":["CGA-q4v3-hcr8-p922"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q4v3-hcr8-p922.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:44Z"}]}}],"modified":"2026-10-02T23:01:42.491236309Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a71192fa-9e46-41e2-97bc-65ee3e7f7bc3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q4v3-hcr8-p922","advisory_id":"a71192fa-9e46-41e2-97bc-65ee3e7f7bc3","event_types":["advisory"],"published_at":"2026-10-25T23:58:52.695105+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:37+00:00","detail_url":"/advisories/advisory%3Aa71192fa-9e46-41e2-97bc-65ee3e7f7bc3","group":{"id":"advisory:a71192fa-9e46-41e2-97bc-65ee3e7f7bc3","revision":1,"primary_event_id":72501,"change":"published","superseded_by":[],"changed":{"id":72501,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-q4v3-hcr8-p922","summary":"CGA-q4v3-hcr8-p922","evidence":"osv:CGA-q4v3-hcr8-p922","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-q4v3-hcr8-p922","aliases":["CGA-q4v3-hcr8-p922"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q4v3-hcr8-p922.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:44Z"}]}}],"modified":"2026-10-02T23:01:42.491236309Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a71192fa-9e46-41e2-97bc-65ee3e7f7bc3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q4v3-hcr8-p922","advisory_id":"a71192fa-9e46-41e2-97bc-65ee3e7f7bc3","event_types":["advisory"],"published_at":"2026-10-25T23:58:52.695105+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:37+00:00","detail_url":"/events/72501"},"members":[{"id":72501,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-q4v3-hcr8-p922","summary":"CGA-q4v3-hcr8-p922","evidence":"osv:CGA-q4v3-hcr8-p922","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-q4v3-hcr8-p922","aliases":["CGA-q4v3-hcr8-p922"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q4v3-hcr8-p922.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:44Z"}]}}],"modified":"2026-10-02T23:01:42.491236309Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a71192fa-9e46-41e2-97bc-65ee3e7f7bc3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q4v3-hcr8-p922","advisory_id":"a71192fa-9e46-41e2-97bc-65ee3e7f7bc3","event_types":["advisory"],"published_at":"2026-10-25T23:58:52.695105+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:37+00:00","detail_url":"/events/72501"}]}},{"id":71942,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-mpmv-57gj-45cc","summary":"CGA-mpmv-57gj-45cc","evidence":"osv:CGA-mpmv-57gj-45cc","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mpmv-57gj-45cc","aliases":["CGA-mpmv-57gj-45cc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mpmv-57gj-45cc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:40.348051167Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bb417296-cf07-4162-8617-e2e24f10a620","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mpmv-57gj-45cc","advisory_id":"bb417296-cf07-4162-8617-e2e24f10a620","event_types":["advisory"],"published_at":"2026-10-25T23:57:32.107884+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/advisories/advisory%3Abb417296-cf07-4162-8617-e2e24f10a620","group":{"id":"advisory:bb417296-cf07-4162-8617-e2e24f10a620","revision":1,"primary_event_id":72486,"change":"published","superseded_by":[],"changed":{"id":72486,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-mpmv-57gj-45cc","summary":"CGA-mpmv-57gj-45cc","evidence":"osv:CGA-mpmv-57gj-45cc","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mpmv-57gj-45cc","aliases":["CGA-mpmv-57gj-45cc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mpmv-57gj-45cc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:40.348051167Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bb417296-cf07-4162-8617-e2e24f10a620","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mpmv-57gj-45cc","advisory_id":"bb417296-cf07-4162-8617-e2e24f10a620","event_types":["advisory"],"published_at":"2026-10-25T23:57:32.107884+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/72486"},"members":[{"id":72486,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-mpmv-57gj-45cc","summary":"CGA-mpmv-57gj-45cc","evidence":"osv:CGA-mpmv-57gj-45cc","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mpmv-57gj-45cc","aliases":["CGA-mpmv-57gj-45cc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mpmv-57gj-45cc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:40.348051167Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bb417296-cf07-4162-8617-e2e24f10a620","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mpmv-57gj-45cc","advisory_id":"bb417296-cf07-4162-8617-e2e24f10a620","event_types":["advisory"],"published_at":"2026-10-25T23:57:32.107884+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/72486"}]}},{"id":71803,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-92m5-wj5v-mqqx","summary":"CGA-92m5-wj5v-mqqx","evidence":"osv:CGA-92m5-wj5v-mqqx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-92m5-wj5v-mqqx","aliases":["CGA-92m5-wj5v-mqqx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-92m5-wj5v-mqqx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:28.678473395Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:be865542-489e-4852-abe8-902aa14abf93","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-92m5-wj5v-mqqx","advisory_id":"be865542-489e-4852-abe8-902aa14abf93","event_types":["advisory"],"published_at":"2026-10-25T23:39:09.904958+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:39+00:00","detail_url":"/advisories/advisory%3Abe865542-489e-4852-abe8-902aa14abf93","group":{"id":"advisory:be865542-489e-4852-abe8-902aa14abf93","revision":1,"primary_event_id":72272,"change":"published","superseded_by":[],"changed":{"id":72272,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-92m5-wj5v-mqqx","summary":"CGA-92m5-wj5v-mqqx","evidence":"osv:CGA-92m5-wj5v-mqqx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-92m5-wj5v-mqqx","aliases":["CGA-92m5-wj5v-mqqx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-92m5-wj5v-mqqx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:28.678473395Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:be865542-489e-4852-abe8-902aa14abf93","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-92m5-wj5v-mqqx","advisory_id":"be865542-489e-4852-abe8-902aa14abf93","event_types":["advisory"],"published_at":"2026-10-25T23:39:09.904958+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:39+00:00","detail_url":"/events/72272"},"members":[{"id":72272,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-92m5-wj5v-mqqx","summary":"CGA-92m5-wj5v-mqqx","evidence":"osv:CGA-92m5-wj5v-mqqx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-92m5-wj5v-mqqx","aliases":["CGA-92m5-wj5v-mqqx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-92m5-wj5v-mqqx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:28.678473395Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:be865542-489e-4852-abe8-902aa14abf93","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-92m5-wj5v-mqqx","advisory_id":"be865542-489e-4852-abe8-902aa14abf93","event_types":["advisory"],"published_at":"2026-10-25T23:39:09.904958+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:39+00:00","detail_url":"/events/72272"}]}},{"id":71729,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8phf-cfm3-gwjp","summary":"CGA-8phf-cfm3-gwjp","evidence":"osv:CGA-8phf-cfm3-gwjp","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8phf-cfm3-gwjp","aliases":["CGA-8phf-cfm3-gwjp"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8phf-cfm3-gwjp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:50Z"}]}}],"modified":"2026-10-02T23:01:18.700310945Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62a35368-82ec-40e0-89b4-0898ad886ed4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8phf-cfm3-gwjp","advisory_id":"62a35368-82ec-40e0-89b4-0898ad886ed4","event_types":["advisory"],"published_at":"2026-10-25T23:32:44.352233+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:35+00:00","detail_url":"/advisories/advisory%3A62a35368-82ec-40e0-89b4-0898ad886ed4","group":{"id":"advisory:62a35368-82ec-40e0-89b4-0898ad886ed4","revision":1,"primary_event_id":72174,"change":"published","superseded_by":[],"changed":{"id":72174,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8phf-cfm3-gwjp","summary":"CGA-8phf-cfm3-gwjp","evidence":"osv:CGA-8phf-cfm3-gwjp","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8phf-cfm3-gwjp","aliases":["CGA-8phf-cfm3-gwjp"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8phf-cfm3-gwjp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:50Z"}]}}],"modified":"2026-10-02T23:01:18.700310945Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62a35368-82ec-40e0-89b4-0898ad886ed4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8phf-cfm3-gwjp","advisory_id":"62a35368-82ec-40e0-89b4-0898ad886ed4","event_types":["advisory"],"published_at":"2026-10-25T23:32:44.352233+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:35+00:00","detail_url":"/events/72174"},"members":[{"id":72174,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-8phf-cfm3-gwjp","summary":"CGA-8phf-cfm3-gwjp","evidence":"osv:CGA-8phf-cfm3-gwjp","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8phf-cfm3-gwjp","aliases":["CGA-8phf-cfm3-gwjp"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8phf-cfm3-gwjp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:50Z"}]}}],"modified":"2026-10-02T23:01:18.700310945Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62a35368-82ec-40e0-89b4-0898ad886ed4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8phf-cfm3-gwjp","advisory_id":"62a35368-82ec-40e0-89b4-0898ad886ed4","event_types":["advisory"],"published_at":"2026-10-25T23:32:44.352233+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:35+00:00","detail_url":"/events/72174"}]}},{"id":71696,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-5wqx-8pr4-v5pc","summary":"CGA-5wqx-8pr4-v5pc","evidence":"osv:CGA-5wqx-8pr4-v5pc","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5wqx-8pr4-v5pc","aliases":["CGA-5wqx-8pr4-v5pc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5wqx-8pr4-v5pc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:16.537780243Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2a8f89b9-6946-4efc-a6ad-67e70a82bbe6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5wqx-8pr4-v5pc","advisory_id":"2a8f89b9-6946-4efc-a6ad-67e70a82bbe6","event_types":["advisory"],"published_at":"2026-10-25T23:29:59.57731+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:40+00:00","detail_url":"/advisories/advisory%3A2a8f89b9-6946-4efc-a6ad-67e70a82bbe6","group":{"id":"advisory:2a8f89b9-6946-4efc-a6ad-67e70a82bbe6","revision":1,"primary_event_id":72136,"change":"published","superseded_by":[],"changed":{"id":72136,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-5wqx-8pr4-v5pc","summary":"CGA-5wqx-8pr4-v5pc","evidence":"osv:CGA-5wqx-8pr4-v5pc","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5wqx-8pr4-v5pc","aliases":["CGA-5wqx-8pr4-v5pc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5wqx-8pr4-v5pc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:16.537780243Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2a8f89b9-6946-4efc-a6ad-67e70a82bbe6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5wqx-8pr4-v5pc","advisory_id":"2a8f89b9-6946-4efc-a6ad-67e70a82bbe6","event_types":["advisory"],"published_at":"2026-10-25T23:29:59.57731+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:40+00:00","detail_url":"/events/72136"},"members":[{"id":72136,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-5wqx-8pr4-v5pc","summary":"CGA-5wqx-8pr4-v5pc","evidence":"osv:CGA-5wqx-8pr4-v5pc","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5wqx-8pr4-v5pc","aliases":["CGA-5wqx-8pr4-v5pc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5wqx-8pr4-v5pc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:16.537780243Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2a8f89b9-6946-4efc-a6ad-67e70a82bbe6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5wqx-8pr4-v5pc","advisory_id":"2a8f89b9-6946-4efc-a6ad-67e70a82bbe6","event_types":["advisory"],"published_at":"2026-10-25T23:29:59.57731+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:40+00:00","detail_url":"/events/72136"}]}},{"id":71638,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-p3g4-r4gh-7pc9","summary":"CGA-p3g4-r4gh-7pc9","evidence":"osv:CGA-p3g4-r4gh-7pc9","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p3g4-r4gh-7pc9","aliases":["CGA-p3g4-r4gh-7pc9"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p3g4-r4gh-7pc9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:49Z"}]}}],"modified":"2026-10-02T23:01:09.449072997Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:90a2a779-4498-4c3e-b239-bd0a6f4fdde5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p3g4-r4gh-7pc9","advisory_id":"90a2a779-4498-4c3e-b239-bd0a6f4fdde5","event_types":["advisory"],"published_at":"2026-10-25T23:25:02.833168+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:40+00:00","detail_url":"/advisories/advisory%3A90a2a779-4498-4c3e-b239-bd0a6f4fdde5","group":{"id":"advisory:90a2a779-4498-4c3e-b239-bd0a6f4fdde5","revision":1,"primary_event_id":72069,"change":"published","superseded_by":[],"changed":{"id":72069,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-p3g4-r4gh-7pc9","summary":"CGA-p3g4-r4gh-7pc9","evidence":"osv:CGA-p3g4-r4gh-7pc9","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p3g4-r4gh-7pc9","aliases":["CGA-p3g4-r4gh-7pc9"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p3g4-r4gh-7pc9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:49Z"}]}}],"modified":"2026-10-02T23:01:09.449072997Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:90a2a779-4498-4c3e-b239-bd0a6f4fdde5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p3g4-r4gh-7pc9","advisory_id":"90a2a779-4498-4c3e-b239-bd0a6f4fdde5","event_types":["advisory"],"published_at":"2026-10-25T23:25:02.833168+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:40+00:00","detail_url":"/events/72069"},"members":[{"id":72069,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-p3g4-r4gh-7pc9","summary":"CGA-p3g4-r4gh-7pc9","evidence":"osv:CGA-p3g4-r4gh-7pc9","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p3g4-r4gh-7pc9","aliases":["CGA-p3g4-r4gh-7pc9"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p3g4-r4gh-7pc9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:49Z"}]}}],"modified":"2026-10-02T23:01:09.449072997Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:90a2a779-4498-4c3e-b239-bd0a6f4fdde5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p3g4-r4gh-7pc9","advisory_id":"90a2a779-4498-4c3e-b239-bd0a6f4fdde5","event_types":["advisory"],"published_at":"2026-10-25T23:25:02.833168+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:40+00:00","detail_url":"/events/72069"}]}},{"id":71622,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-w3qc-5rj9-7j6h","summary":"CGA-w3qc-5rj9-7j6h","evidence":"osv:CGA-w3qc-5rj9-7j6h","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w3qc-5rj9-7j6h","aliases":["CGA-w3qc-5rj9-7j6h"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w3qc-5rj9-7j6h.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:46Z"}]}}],"modified":"2026-10-02T23:01:11.575852701Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e63b6230-8be8-44e7-82e7-11903f7e6d67","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w3qc-5rj9-7j6h","advisory_id":"e63b6230-8be8-44e7-82e7-11903f7e6d67","event_types":["advisory"],"published_at":"2026-10-25T23:23:41.453263+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:42+00:00","detail_url":"/advisories/advisory%3Ae63b6230-8be8-44e7-82e7-11903f7e6d67","group":{"id":"advisory:e63b6230-8be8-44e7-82e7-11903f7e6d67","revision":1,"primary_event_id":72048,"change":"published","superseded_by":[],"changed":{"id":72048,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-w3qc-5rj9-7j6h","summary":"CGA-w3qc-5rj9-7j6h","evidence":"osv:CGA-w3qc-5rj9-7j6h","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w3qc-5rj9-7j6h","aliases":["CGA-w3qc-5rj9-7j6h"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w3qc-5rj9-7j6h.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:46Z"}]}}],"modified":"2026-10-02T23:01:11.575852701Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e63b6230-8be8-44e7-82e7-11903f7e6d67","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w3qc-5rj9-7j6h","advisory_id":"e63b6230-8be8-44e7-82e7-11903f7e6d67","event_types":["advisory"],"published_at":"2026-10-25T23:23:41.453263+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:42+00:00","detail_url":"/events/72048"},"members":[{"id":72048,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-w3qc-5rj9-7j6h","summary":"CGA-w3qc-5rj9-7j6h","evidence":"osv:CGA-w3qc-5rj9-7j6h","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w3qc-5rj9-7j6h","aliases":["CGA-w3qc-5rj9-7j6h"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w3qc-5rj9-7j6h.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:46Z"}]}}],"modified":"2026-10-02T23:01:11.575852701Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e63b6230-8be8-44e7-82e7-11903f7e6d67","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w3qc-5rj9-7j6h","advisory_id":"e63b6230-8be8-44e7-82e7-11903f7e6d67","event_types":["advisory"],"published_at":"2026-10-25T23:23:41.453263+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:42+00:00","detail_url":"/events/72048"}]}},{"id":71620,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-q2q6-cqc8-p7mm","summary":"CGA-q2q6-cqc8-p7mm","evidence":"osv:CGA-q2q6-cqc8-p7mm","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-q2q6-cqc8-p7mm","aliases":["CGA-q2q6-cqc8-p7mm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q2q6-cqc8-p7mm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:10.573368223Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:34de12cf-5723-4083-978c-bc80f798272c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q2q6-cqc8-p7mm","advisory_id":"34de12cf-5723-4083-978c-bc80f798272c","event_types":["advisory"],"published_at":"2026-10-25T23:23:24.894982+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:39+00:00","detail_url":"/advisories/advisory%3A34de12cf-5723-4083-978c-bc80f798272c","group":{"id":"advisory:34de12cf-5723-4083-978c-bc80f798272c","revision":1,"primary_event_id":72044,"change":"published","superseded_by":[],"changed":{"id":72044,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-q2q6-cqc8-p7mm","summary":"CGA-q2q6-cqc8-p7mm","evidence":"osv:CGA-q2q6-cqc8-p7mm","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-q2q6-cqc8-p7mm","aliases":["CGA-q2q6-cqc8-p7mm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q2q6-cqc8-p7mm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:10.573368223Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:34de12cf-5723-4083-978c-bc80f798272c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q2q6-cqc8-p7mm","advisory_id":"34de12cf-5723-4083-978c-bc80f798272c","event_types":["advisory"],"published_at":"2026-10-25T23:23:24.894982+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:39+00:00","detail_url":"/events/72044"},"members":[{"id":72044,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-q2q6-cqc8-p7mm","summary":"CGA-q2q6-cqc8-p7mm","evidence":"osv:CGA-q2q6-cqc8-p7mm","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-q2q6-cqc8-p7mm","aliases":["CGA-q2q6-cqc8-p7mm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q2q6-cqc8-p7mm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:10.573368223Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:34de12cf-5723-4083-978c-bc80f798272c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q2q6-cqc8-p7mm","advisory_id":"34de12cf-5723-4083-978c-bc80f798272c","event_types":["advisory"],"published_at":"2026-10-25T23:23:24.894982+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:39+00:00","detail_url":"/events/72044"}]}},{"id":71613,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-pmjg-27p5-83fj","summary":"CGA-pmjg-27p5-83fj","evidence":"osv:CGA-pmjg-27p5-83fj","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pmjg-27p5-83fj","aliases":["CGA-pmjg-27p5-83fj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pmjg-27p5-83fj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:45Z"}]}}],"modified":"2026-10-02T23:01:09.903928801Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:409a637e-1373-4683-8607-9d4219b80fe8","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pmjg-27p5-83fj","advisory_id":"409a637e-1373-4683-8607-9d4219b80fe8","event_types":["advisory"],"published_at":"2026-10-25T23:23:03.010216+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:41+00:00","detail_url":"/advisories/advisory%3A409a637e-1373-4683-8607-9d4219b80fe8","group":{"id":"advisory:409a637e-1373-4683-8607-9d4219b80fe8","revision":1,"primary_event_id":72037,"change":"published","superseded_by":[],"changed":{"id":72037,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-pmjg-27p5-83fj","summary":"CGA-pmjg-27p5-83fj","evidence":"osv:CGA-pmjg-27p5-83fj","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pmjg-27p5-83fj","aliases":["CGA-pmjg-27p5-83fj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pmjg-27p5-83fj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:45Z"}]}}],"modified":"2026-10-02T23:01:09.903928801Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:409a637e-1373-4683-8607-9d4219b80fe8","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pmjg-27p5-83fj","advisory_id":"409a637e-1373-4683-8607-9d4219b80fe8","event_types":["advisory"],"published_at":"2026-10-25T23:23:03.010216+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:41+00:00","detail_url":"/events/72037"},"members":[{"id":72037,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-pmjg-27p5-83fj","summary":"CGA-pmjg-27p5-83fj","evidence":"osv:CGA-pmjg-27p5-83fj","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pmjg-27p5-83fj","aliases":["CGA-pmjg-27p5-83fj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pmjg-27p5-83fj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:45Z"}]}}],"modified":"2026-10-02T23:01:09.903928801Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:409a637e-1373-4683-8607-9d4219b80fe8","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pmjg-27p5-83fj","advisory_id":"409a637e-1373-4683-8607-9d4219b80fe8","event_types":["advisory"],"published_at":"2026-10-25T23:23:03.010216+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:41+00:00","detail_url":"/events/72037"}]}},{"id":71590,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-85g7-x33p-9cx9","summary":"CGA-85g7-x33p-9cx9","evidence":"osv:CGA-85g7-x33p-9cx9","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-85g7-x33p-9cx9","aliases":["CGA-85g7-x33p-9cx9"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-85g7-x33p-9cx9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:01:07.877222229Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4c1e0b7d-e547-4e6e-8dcd-afcd4d2e71fd","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-85g7-x33p-9cx9","advisory_id":"4c1e0b7d-e547-4e6e-8dcd-afcd4d2e71fd","event_types":["advisory"],"published_at":"2026-10-25T23:21:33.168406+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:39+00:00","detail_url":"/advisories/advisory%3A4c1e0b7d-e547-4e6e-8dcd-afcd4d2e71fd","group":{"id":"advisory:4c1e0b7d-e547-4e6e-8dcd-afcd4d2e71fd","revision":1,"primary_event_id":72009,"change":"published","superseded_by":[],"changed":{"id":72009,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-85g7-x33p-9cx9","summary":"CGA-85g7-x33p-9cx9","evidence":"osv:CGA-85g7-x33p-9cx9","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-85g7-x33p-9cx9","aliases":["CGA-85g7-x33p-9cx9"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-85g7-x33p-9cx9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:01:07.877222229Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4c1e0b7d-e547-4e6e-8dcd-afcd4d2e71fd","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-85g7-x33p-9cx9","advisory_id":"4c1e0b7d-e547-4e6e-8dcd-afcd4d2e71fd","event_types":["advisory"],"published_at":"2026-10-25T23:21:33.168406+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:39+00:00","detail_url":"/events/72009"},"members":[{"id":72009,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-85g7-x33p-9cx9","summary":"CGA-85g7-x33p-9cx9","evidence":"osv:CGA-85g7-x33p-9cx9","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-85g7-x33p-9cx9","aliases":["CGA-85g7-x33p-9cx9"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-85g7-x33p-9cx9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:01:07.877222229Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4c1e0b7d-e547-4e6e-8dcd-afcd4d2e71fd","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-85g7-x33p-9cx9","advisory_id":"4c1e0b7d-e547-4e6e-8dcd-afcd4d2e71fd","event_types":["advisory"],"published_at":"2026-10-25T23:21:33.168406+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:39+00:00","detail_url":"/events/72009"}]}},{"id":71560,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-vcgp-rf4v-cg3v","summary":"CGA-vcgp-rf4v-cg3v","evidence":"osv:CGA-vcgp-rf4v-cg3v","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vcgp-rf4v-cg3v","aliases":["CGA-vcgp-rf4v-cg3v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vcgp-rf4v-cg3v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:50Z"}]}}],"modified":"2026-10-02T23:01:05.213629155Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:28ba4646-f663-41bf-bdf7-32d050160488","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vcgp-rf4v-cg3v","advisory_id":"28ba4646-f663-41bf-bdf7-32d050160488","event_types":["advisory"],"published_at":"2026-10-25T23:19:18.948031+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:36+00:00","detail_url":"/advisories/advisory%3A28ba4646-f663-41bf-bdf7-32d050160488","group":{"id":"advisory:28ba4646-f663-41bf-bdf7-32d050160488","revision":1,"primary_event_id":71975,"change":"published","superseded_by":[],"changed":{"id":71975,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-vcgp-rf4v-cg3v","summary":"CGA-vcgp-rf4v-cg3v","evidence":"osv:CGA-vcgp-rf4v-cg3v","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vcgp-rf4v-cg3v","aliases":["CGA-vcgp-rf4v-cg3v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vcgp-rf4v-cg3v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:50Z"}]}}],"modified":"2026-10-02T23:01:05.213629155Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:28ba4646-f663-41bf-bdf7-32d050160488","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vcgp-rf4v-cg3v","advisory_id":"28ba4646-f663-41bf-bdf7-32d050160488","event_types":["advisory"],"published_at":"2026-10-25T23:19:18.948031+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:36+00:00","detail_url":"/events/71975"},"members":[{"id":71975,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-vcgp-rf4v-cg3v","summary":"CGA-vcgp-rf4v-cg3v","evidence":"osv:CGA-vcgp-rf4v-cg3v","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vcgp-rf4v-cg3v","aliases":["CGA-vcgp-rf4v-cg3v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vcgp-rf4v-cg3v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:50Z"}]}}],"modified":"2026-10-02T23:01:05.213629155Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:28ba4646-f663-41bf-bdf7-32d050160488","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vcgp-rf4v-cg3v","advisory_id":"28ba4646-f663-41bf-bdf7-32d050160488","event_types":["advisory"],"published_at":"2026-10-25T23:19:18.948031+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:36+00:00","detail_url":"/events/71975"}]}},{"id":71550,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-j244-5v8c-xhcw","summary":"CGA-j244-5v8c-xhcw","evidence":"osv:CGA-j244-5v8c-xhcw","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j244-5v8c-xhcw","aliases":["CGA-j244-5v8c-xhcw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j244-5v8c-xhcw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:02.306865421Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62ba176e-25bb-4650-9f0f-61e056ae7173","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j244-5v8c-xhcw","advisory_id":"62ba176e-25bb-4650-9f0f-61e056ae7173","event_types":["advisory"],"published_at":"2026-10-25T23:18:33.270967+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:43+00:00","detail_url":"/advisories/advisory%3A62ba176e-25bb-4650-9f0f-61e056ae7173","group":{"id":"advisory:62ba176e-25bb-4650-9f0f-61e056ae7173","revision":1,"primary_event_id":71965,"change":"published","superseded_by":[],"changed":{"id":71965,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-j244-5v8c-xhcw","summary":"CGA-j244-5v8c-xhcw","evidence":"osv:CGA-j244-5v8c-xhcw","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j244-5v8c-xhcw","aliases":["CGA-j244-5v8c-xhcw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j244-5v8c-xhcw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:02.306865421Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62ba176e-25bb-4650-9f0f-61e056ae7173","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j244-5v8c-xhcw","advisory_id":"62ba176e-25bb-4650-9f0f-61e056ae7173","event_types":["advisory"],"published_at":"2026-10-25T23:18:33.270967+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:43+00:00","detail_url":"/events/71965"},"members":[{"id":71965,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-j244-5v8c-xhcw","summary":"CGA-j244-5v8c-xhcw","evidence":"osv:CGA-j244-5v8c-xhcw","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j244-5v8c-xhcw","aliases":["CGA-j244-5v8c-xhcw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j244-5v8c-xhcw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:01:02.306865421Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62ba176e-25bb-4650-9f0f-61e056ae7173","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j244-5v8c-xhcw","advisory_id":"62ba176e-25bb-4650-9f0f-61e056ae7173","event_types":["advisory"],"published_at":"2026-10-25T23:18:33.270967+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:43+00:00","detail_url":"/events/71965"}]}},{"id":71479,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-rhrq-xcr8-q7h8","summary":"CGA-rhrq-xcr8-q7h8","evidence":"osv:CGA-rhrq-xcr8-q7h8","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rhrq-xcr8-q7h8","aliases":["CGA-rhrq-xcr8-q7h8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rhrq-xcr8-q7h8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:58.036582021Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3b917933-ff17-4c68-a186-e54d6237c5a7","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rhrq-xcr8-q7h8","advisory_id":"3b917933-ff17-4c68-a186-e54d6237c5a7","event_types":["advisory"],"published_at":"2026-10-25T23:13:19.172238+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:40+00:00","detail_url":"/advisories/advisory%3A3b917933-ff17-4c68-a186-e54d6237c5a7","group":{"id":"advisory:3b917933-ff17-4c68-a186-e54d6237c5a7","revision":1,"primary_event_id":71886,"change":"published","superseded_by":[],"changed":{"id":71886,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-rhrq-xcr8-q7h8","summary":"CGA-rhrq-xcr8-q7h8","evidence":"osv:CGA-rhrq-xcr8-q7h8","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rhrq-xcr8-q7h8","aliases":["CGA-rhrq-xcr8-q7h8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rhrq-xcr8-q7h8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:58.036582021Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3b917933-ff17-4c68-a186-e54d6237c5a7","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rhrq-xcr8-q7h8","advisory_id":"3b917933-ff17-4c68-a186-e54d6237c5a7","event_types":["advisory"],"published_at":"2026-10-25T23:13:19.172238+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:40+00:00","detail_url":"/events/71886"},"members":[{"id":71886,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-rhrq-xcr8-q7h8","summary":"CGA-rhrq-xcr8-q7h8","evidence":"osv:CGA-rhrq-xcr8-q7h8","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rhrq-xcr8-q7h8","aliases":["CGA-rhrq-xcr8-q7h8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rhrq-xcr8-q7h8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:58.036582021Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3b917933-ff17-4c68-a186-e54d6237c5a7","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rhrq-xcr8-q7h8","advisory_id":"3b917933-ff17-4c68-a186-e54d6237c5a7","event_types":["advisory"],"published_at":"2026-10-25T23:13:19.172238+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:40+00:00","detail_url":"/events/71886"}]}},{"id":71444,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-mv9m-gf6c-x6v6","summary":"CGA-mv9m-gf6c-x6v6","evidence":"osv:CGA-mv9m-gf6c-x6v6","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mv9m-gf6c-x6v6","aliases":["CGA-mv9m-gf6c-x6v6"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mv9m-gf6c-x6v6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:53.171087557Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bf40df7e-6ef6-495c-87b1-64f88367074e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mv9m-gf6c-x6v6","advisory_id":"bf40df7e-6ef6-495c-87b1-64f88367074e","event_types":["advisory"],"published_at":"2026-10-25T23:10:31.870802+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/advisories/advisory%3Abf40df7e-6ef6-495c-87b1-64f88367074e","group":{"id":"advisory:bf40df7e-6ef6-495c-87b1-64f88367074e","revision":1,"primary_event_id":71843,"change":"published","superseded_by":[],"changed":{"id":71843,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-mv9m-gf6c-x6v6","summary":"CGA-mv9m-gf6c-x6v6","evidence":"osv:CGA-mv9m-gf6c-x6v6","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mv9m-gf6c-x6v6","aliases":["CGA-mv9m-gf6c-x6v6"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mv9m-gf6c-x6v6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:53.171087557Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bf40df7e-6ef6-495c-87b1-64f88367074e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mv9m-gf6c-x6v6","advisory_id":"bf40df7e-6ef6-495c-87b1-64f88367074e","event_types":["advisory"],"published_at":"2026-10-25T23:10:31.870802+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/71843"},"members":[{"id":71843,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-mv9m-gf6c-x6v6","summary":"CGA-mv9m-gf6c-x6v6","evidence":"osv:CGA-mv9m-gf6c-x6v6","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mv9m-gf6c-x6v6","aliases":["CGA-mv9m-gf6c-x6v6"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mv9m-gf6c-x6v6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:53.171087557Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bf40df7e-6ef6-495c-87b1-64f88367074e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mv9m-gf6c-x6v6","advisory_id":"bf40df7e-6ef6-495c-87b1-64f88367074e","event_types":["advisory"],"published_at":"2026-10-25T23:10:31.870802+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/71843"}]}},{"id":71434,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-jj79-3j37-x772","summary":"CGA-jj79-3j37-x772","evidence":"osv:CGA-jj79-3j37-x772","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-jj79-3j37-x772","aliases":["CGA-jj79-3j37-x772"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jj79-3j37-x772.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:42Z"}]}}],"modified":"2026-10-02T23:00:52.367463444Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2b5cc841-95cf-4a72-a7ff-5d3d68c1fdb5","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jj79-3j37-x772","advisory_id":"2b5cc841-95cf-4a72-a7ff-5d3d68c1fdb5","event_types":["advisory"],"published_at":"2026-10-25T23:09:58.058349+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:40+00:00","detail_url":"/advisories/advisory%3A2b5cc841-95cf-4a72-a7ff-5d3d68c1fdb5","group":{"id":"advisory:2b5cc841-95cf-4a72-a7ff-5d3d68c1fdb5","revision":1,"primary_event_id":71833,"change":"published","superseded_by":[],"changed":{"id":71833,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-jj79-3j37-x772","summary":"CGA-jj79-3j37-x772","evidence":"osv:CGA-jj79-3j37-x772","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-jj79-3j37-x772","aliases":["CGA-jj79-3j37-x772"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jj79-3j37-x772.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:42Z"}]}}],"modified":"2026-10-02T23:00:52.367463444Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2b5cc841-95cf-4a72-a7ff-5d3d68c1fdb5","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jj79-3j37-x772","advisory_id":"2b5cc841-95cf-4a72-a7ff-5d3d68c1fdb5","event_types":["advisory"],"published_at":"2026-10-25T23:09:58.058349+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:40+00:00","detail_url":"/events/71833"},"members":[{"id":71833,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-jj79-3j37-x772","summary":"CGA-jj79-3j37-x772","evidence":"osv:CGA-jj79-3j37-x772","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-jj79-3j37-x772","aliases":["CGA-jj79-3j37-x772"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jj79-3j37-x772.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:42Z"}]}}],"modified":"2026-10-02T23:00:52.367463444Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2b5cc841-95cf-4a72-a7ff-5d3d68c1fdb5","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jj79-3j37-x772","advisory_id":"2b5cc841-95cf-4a72-a7ff-5d3d68c1fdb5","event_types":["advisory"],"published_at":"2026-10-25T23:09:58.058349+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:40+00:00","detail_url":"/events/71833"}]}},{"id":71422,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-p948-j2x3-8m95","summary":"CGA-p948-j2x3-8m95","evidence":"osv:CGA-p948-j2x3-8m95","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p948-j2x3-8m95","aliases":["CGA-p948-j2x3-8m95"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p948-j2x3-8m95.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:43Z"}]}}],"modified":"2026-10-02T23:00:50.721898562Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a5f03c03-e455-45ee-9ae1-77184fa3265e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p948-j2x3-8m95","advisory_id":"a5f03c03-e455-45ee-9ae1-77184fa3265e","event_types":["advisory"],"published_at":"2026-10-25T23:09:05.890535+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/advisories/advisory%3Aa5f03c03-e455-45ee-9ae1-77184fa3265e","group":{"id":"advisory:a5f03c03-e455-45ee-9ae1-77184fa3265e","revision":1,"primary_event_id":71817,"change":"published","superseded_by":[],"changed":{"id":71817,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-p948-j2x3-8m95","summary":"CGA-p948-j2x3-8m95","evidence":"osv:CGA-p948-j2x3-8m95","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p948-j2x3-8m95","aliases":["CGA-p948-j2x3-8m95"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p948-j2x3-8m95.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:43Z"}]}}],"modified":"2026-10-02T23:00:50.721898562Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a5f03c03-e455-45ee-9ae1-77184fa3265e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p948-j2x3-8m95","advisory_id":"a5f03c03-e455-45ee-9ae1-77184fa3265e","event_types":["advisory"],"published_at":"2026-10-25T23:09:05.890535+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/events/71817"},"members":[{"id":71817,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-p948-j2x3-8m95","summary":"CGA-p948-j2x3-8m95","evidence":"osv:CGA-p948-j2x3-8m95","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p948-j2x3-8m95","aliases":["CGA-p948-j2x3-8m95"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p948-j2x3-8m95.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:43Z"}]}}],"modified":"2026-10-02T23:00:50.721898562Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a5f03c03-e455-45ee-9ae1-77184fa3265e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p948-j2x3-8m95","advisory_id":"a5f03c03-e455-45ee-9ae1-77184fa3265e","event_types":["advisory"],"published_at":"2026-10-25T23:09:05.890535+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/events/71817"}]}},{"id":71389,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-fp4f-4xw2-7c5j","summary":"CGA-fp4f-4xw2-7c5j","evidence":"osv:CGA-fp4f-4xw2-7c5j","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-fp4f-4xw2-7c5j","aliases":["CGA-fp4f-4xw2-7c5j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fp4f-4xw2-7c5j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:47.706786109Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e6c86db-5e84-49d3-a53b-d80d03009705","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fp4f-4xw2-7c5j","advisory_id":"4e6c86db-5e84-49d3-a53b-d80d03009705","event_types":["advisory"],"published_at":"2026-10-25T23:07:28.139931+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:40+00:00","detail_url":"/advisories/advisory%3A4e6c86db-5e84-49d3-a53b-d80d03009705","group":{"id":"advisory:4e6c86db-5e84-49d3-a53b-d80d03009705","revision":1,"primary_event_id":71780,"change":"published","superseded_by":[],"changed":{"id":71780,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-fp4f-4xw2-7c5j","summary":"CGA-fp4f-4xw2-7c5j","evidence":"osv:CGA-fp4f-4xw2-7c5j","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-fp4f-4xw2-7c5j","aliases":["CGA-fp4f-4xw2-7c5j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fp4f-4xw2-7c5j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:47.706786109Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e6c86db-5e84-49d3-a53b-d80d03009705","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fp4f-4xw2-7c5j","advisory_id":"4e6c86db-5e84-49d3-a53b-d80d03009705","event_types":["advisory"],"published_at":"2026-10-25T23:07:28.139931+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:40+00:00","detail_url":"/events/71780"},"members":[{"id":71780,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-fp4f-4xw2-7c5j","summary":"CGA-fp4f-4xw2-7c5j","evidence":"osv:CGA-fp4f-4xw2-7c5j","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-fp4f-4xw2-7c5j","aliases":["CGA-fp4f-4xw2-7c5j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fp4f-4xw2-7c5j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:47.706786109Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e6c86db-5e84-49d3-a53b-d80d03009705","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fp4f-4xw2-7c5j","advisory_id":"4e6c86db-5e84-49d3-a53b-d80d03009705","event_types":["advisory"],"published_at":"2026-10-25T23:07:28.139931+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:40+00:00","detail_url":"/events/71780"}]}},{"id":71372,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-f26h-jp5v-xg2q","summary":"CGA-f26h-jp5v-xg2q","evidence":"osv:CGA-f26h-jp5v-xg2q","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-f26h-jp5v-xg2q","aliases":["CGA-f26h-jp5v-xg2q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f26h-jp5v-xg2q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:46Z"}]}}],"modified":"2026-10-02T23:00:45.943233711Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:95a24b47-605a-49bf-81d8-61e3a864f877","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f26h-jp5v-xg2q","advisory_id":"95a24b47-605a-49bf-81d8-61e3a864f877","event_types":["advisory"],"published_at":"2026-10-25T23:06:36.502451+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:37+00:00","detail_url":"/advisories/advisory%3A95a24b47-605a-49bf-81d8-61e3a864f877","group":{"id":"advisory:95a24b47-605a-49bf-81d8-61e3a864f877","revision":1,"primary_event_id":71763,"change":"published","superseded_by":[],"changed":{"id":71763,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-f26h-jp5v-xg2q","summary":"CGA-f26h-jp5v-xg2q","evidence":"osv:CGA-f26h-jp5v-xg2q","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-f26h-jp5v-xg2q","aliases":["CGA-f26h-jp5v-xg2q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f26h-jp5v-xg2q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:46Z"}]}}],"modified":"2026-10-02T23:00:45.943233711Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:95a24b47-605a-49bf-81d8-61e3a864f877","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f26h-jp5v-xg2q","advisory_id":"95a24b47-605a-49bf-81d8-61e3a864f877","event_types":["advisory"],"published_at":"2026-10-25T23:06:36.502451+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:37+00:00","detail_url":"/events/71763"},"members":[{"id":71763,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-f26h-jp5v-xg2q","summary":"CGA-f26h-jp5v-xg2q","evidence":"osv:CGA-f26h-jp5v-xg2q","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-f26h-jp5v-xg2q","aliases":["CGA-f26h-jp5v-xg2q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f26h-jp5v-xg2q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:46Z"}]}}],"modified":"2026-10-02T23:00:45.943233711Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:95a24b47-605a-49bf-81d8-61e3a864f877","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f26h-jp5v-xg2q","advisory_id":"95a24b47-605a-49bf-81d8-61e3a864f877","event_types":["advisory"],"published_at":"2026-10-25T23:06:36.502451+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:37+00:00","detail_url":"/events/71763"}]}},{"id":71303,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-7w97-cqmq-6g74","summary":"CGA-7w97-cqmq-6g74","evidence":"osv:CGA-7w97-cqmq-6g74","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7w97-cqmq-6g74","aliases":["CGA-7w97-cqmq-6g74"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7w97-cqmq-6g74.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:44Z"}]}}],"modified":"2026-10-02T23:00:39.546180860Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:22df0b12-77d6-4eb0-8803-2c7d043a7bbf","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7w97-cqmq-6g74","advisory_id":"22df0b12-77d6-4eb0-8803-2c7d043a7bbf","event_types":["advisory"],"published_at":"2026-10-25T23:01:55.558144+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/advisories/advisory%3A22df0b12-77d6-4eb0-8803-2c7d043a7bbf","group":{"id":"advisory:22df0b12-77d6-4eb0-8803-2c7d043a7bbf","revision":1,"primary_event_id":71692,"change":"published","superseded_by":[],"changed":{"id":71692,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-7w97-cqmq-6g74","summary":"CGA-7w97-cqmq-6g74","evidence":"osv:CGA-7w97-cqmq-6g74","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7w97-cqmq-6g74","aliases":["CGA-7w97-cqmq-6g74"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7w97-cqmq-6g74.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:44Z"}]}}],"modified":"2026-10-02T23:00:39.546180860Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:22df0b12-77d6-4eb0-8803-2c7d043a7bbf","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7w97-cqmq-6g74","advisory_id":"22df0b12-77d6-4eb0-8803-2c7d043a7bbf","event_types":["advisory"],"published_at":"2026-10-25T23:01:55.558144+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/events/71692"},"members":[{"id":71692,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-7w97-cqmq-6g74","summary":"CGA-7w97-cqmq-6g74","evidence":"osv:CGA-7w97-cqmq-6g74","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7w97-cqmq-6g74","aliases":["CGA-7w97-cqmq-6g74"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7w97-cqmq-6g74.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:44Z"}]}}],"modified":"2026-10-02T23:00:39.546180860Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:22df0b12-77d6-4eb0-8803-2c7d043a7bbf","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7w97-cqmq-6g74","advisory_id":"22df0b12-77d6-4eb0-8803-2c7d043a7bbf","event_types":["advisory"],"published_at":"2026-10-25T23:01:55.558144+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/events/71692"}]}},{"id":71293,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-7cgw-49g4-9fhv","summary":"CGA-7cgw-49g4-9fhv","evidence":"osv:CGA-7cgw-49g4-9fhv","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7cgw-49g4-9fhv","aliases":["CGA-7cgw-49g4-9fhv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7cgw-49g4-9fhv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:37.646346175Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0df46ed2-d6ae-432d-8e4f-f7d0c0ee442e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7cgw-49g4-9fhv","advisory_id":"0df46ed2-d6ae-432d-8e4f-f7d0c0ee442e","event_types":["advisory"],"published_at":"2026-10-25T23:01:12.437576+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/advisories/advisory%3A0df46ed2-d6ae-432d-8e4f-f7d0c0ee442e","group":{"id":"advisory:0df46ed2-d6ae-432d-8e4f-f7d0c0ee442e","revision":1,"primary_event_id":71679,"change":"published","superseded_by":[],"changed":{"id":71679,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-7cgw-49g4-9fhv","summary":"CGA-7cgw-49g4-9fhv","evidence":"osv:CGA-7cgw-49g4-9fhv","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7cgw-49g4-9fhv","aliases":["CGA-7cgw-49g4-9fhv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7cgw-49g4-9fhv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:37.646346175Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0df46ed2-d6ae-432d-8e4f-f7d0c0ee442e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7cgw-49g4-9fhv","advisory_id":"0df46ed2-d6ae-432d-8e4f-f7d0c0ee442e","event_types":["advisory"],"published_at":"2026-10-25T23:01:12.437576+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/events/71679"},"members":[{"id":71679,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-7cgw-49g4-9fhv","summary":"CGA-7cgw-49g4-9fhv","evidence":"osv:CGA-7cgw-49g4-9fhv","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7cgw-49g4-9fhv","aliases":["CGA-7cgw-49g4-9fhv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7cgw-49g4-9fhv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:37.646346175Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0df46ed2-d6ae-432d-8e4f-f7d0c0ee442e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7cgw-49g4-9fhv","advisory_id":"0df46ed2-d6ae-432d-8e4f-f7d0c0ee442e","event_types":["advisory"],"published_at":"2026-10-25T23:01:12.437576+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/events/71679"}]}},{"id":71211,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-9mx7-54mj-w6g3","summary":"CGA-9mx7-54mj-w6g3","evidence":"osv:CGA-9mx7-54mj-w6g3","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9mx7-54mj-w6g3","aliases":["CGA-9mx7-54mj-w6g3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9mx7-54mj-w6g3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:47Z"}]}}],"modified":"2026-10-02T23:00:29.109377171Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4629aaea-7ec3-4ed1-a350-69d8f979166b","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9mx7-54mj-w6g3","advisory_id":"4629aaea-7ec3-4ed1-a350-69d8f979166b","event_types":["advisory"],"published_at":"2026-10-25T22:56:35.790717+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:38+00:00","detail_url":"/advisories/advisory%3A4629aaea-7ec3-4ed1-a350-69d8f979166b","group":{"id":"advisory:4629aaea-7ec3-4ed1-a350-69d8f979166b","revision":1,"primary_event_id":71596,"change":"published","superseded_by":[],"changed":{"id":71596,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-9mx7-54mj-w6g3","summary":"CGA-9mx7-54mj-w6g3","evidence":"osv:CGA-9mx7-54mj-w6g3","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9mx7-54mj-w6g3","aliases":["CGA-9mx7-54mj-w6g3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9mx7-54mj-w6g3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:47Z"}]}}],"modified":"2026-10-02T23:00:29.109377171Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4629aaea-7ec3-4ed1-a350-69d8f979166b","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9mx7-54mj-w6g3","advisory_id":"4629aaea-7ec3-4ed1-a350-69d8f979166b","event_types":["advisory"],"published_at":"2026-10-25T22:56:35.790717+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:38+00:00","detail_url":"/events/71596"},"members":[{"id":71596,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-9mx7-54mj-w6g3","summary":"CGA-9mx7-54mj-w6g3","evidence":"osv:CGA-9mx7-54mj-w6g3","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9mx7-54mj-w6g3","aliases":["CGA-9mx7-54mj-w6g3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9mx7-54mj-w6g3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:47Z"}]}}],"modified":"2026-10-02T23:00:29.109377171Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4629aaea-7ec3-4ed1-a350-69d8f979166b","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9mx7-54mj-w6g3","advisory_id":"4629aaea-7ec3-4ed1-a350-69d8f979166b","event_types":["advisory"],"published_at":"2026-10-25T22:56:35.790717+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:38+00:00","detail_url":"/events/71596"}]}},{"id":71175,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-4727-2qq8-gpp7","summary":"CGA-4727-2qq8-gpp7","evidence":"osv:CGA-4727-2qq8-gpp7","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4727-2qq8-gpp7","aliases":["CGA-4727-2qq8-gpp7"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4727-2qq8-gpp7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:45Z"}]}}],"modified":"2026-10-02T23:00:24.213307771Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f8f84c8a-f53c-43e6-b254-cbe0b33ebf4a","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4727-2qq8-gpp7","advisory_id":"f8f84c8a-f53c-43e6-b254-cbe0b33ebf4a","event_types":["advisory"],"published_at":"2026-10-25T22:54:31.749003+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:36+00:00","detail_url":"/advisories/advisory%3Af8f84c8a-f53c-43e6-b254-cbe0b33ebf4a","group":{"id":"advisory:f8f84c8a-f53c-43e6-b254-cbe0b33ebf4a","revision":1,"primary_event_id":71555,"change":"published","superseded_by":[],"changed":{"id":71555,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-4727-2qq8-gpp7","summary":"CGA-4727-2qq8-gpp7","evidence":"osv:CGA-4727-2qq8-gpp7","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4727-2qq8-gpp7","aliases":["CGA-4727-2qq8-gpp7"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4727-2qq8-gpp7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:45Z"}]}}],"modified":"2026-10-02T23:00:24.213307771Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f8f84c8a-f53c-43e6-b254-cbe0b33ebf4a","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4727-2qq8-gpp7","advisory_id":"f8f84c8a-f53c-43e6-b254-cbe0b33ebf4a","event_types":["advisory"],"published_at":"2026-10-25T22:54:31.749003+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:36+00:00","detail_url":"/events/71555"},"members":[{"id":71555,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-4727-2qq8-gpp7","summary":"CGA-4727-2qq8-gpp7","evidence":"osv:CGA-4727-2qq8-gpp7","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4727-2qq8-gpp7","aliases":["CGA-4727-2qq8-gpp7"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4727-2qq8-gpp7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.2.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:45Z"}]}}],"modified":"2026-10-02T23:00:24.213307771Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f8f84c8a-f53c-43e6-b254-cbe0b33ebf4a","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4727-2qq8-gpp7","advisory_id":"f8f84c8a-f53c-43e6-b254-cbe0b33ebf4a","event_types":["advisory"],"published_at":"2026-10-25T22:54:31.749003+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:36+00:00","detail_url":"/events/71555"}]}},{"id":71157,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-34cc-mxv5-fmf4","summary":"CGA-34cc-mxv5-fmf4","evidence":"osv:CGA-34cc-mxv5-fmf4","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-34cc-mxv5-fmf4","aliases":["CGA-34cc-mxv5-fmf4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-34cc-mxv5-fmf4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:22.407809898Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:408b9946-322a-485a-a264-ab8f0dafffb3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-34cc-mxv5-fmf4","advisory_id":"408b9946-322a-485a-a264-ab8f0dafffb3","event_types":["advisory"],"published_at":"2026-10-25T22:53:45.034598+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/advisories/advisory%3A408b9946-322a-485a-a264-ab8f0dafffb3","group":{"id":"advisory:408b9946-322a-485a-a264-ab8f0dafffb3","revision":1,"primary_event_id":71536,"change":"published","superseded_by":[],"changed":{"id":71536,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-34cc-mxv5-fmf4","summary":"CGA-34cc-mxv5-fmf4","evidence":"osv:CGA-34cc-mxv5-fmf4","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-34cc-mxv5-fmf4","aliases":["CGA-34cc-mxv5-fmf4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-34cc-mxv5-fmf4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:22.407809898Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:408b9946-322a-485a-a264-ab8f0dafffb3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-34cc-mxv5-fmf4","advisory_id":"408b9946-322a-485a-a264-ab8f0dafffb3","event_types":["advisory"],"published_at":"2026-10-25T22:53:45.034598+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/71536"},"members":[{"id":71536,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-34cc-mxv5-fmf4","summary":"CGA-34cc-mxv5-fmf4","evidence":"osv:CGA-34cc-mxv5-fmf4","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-34cc-mxv5-fmf4","aliases":["CGA-34cc-mxv5-fmf4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-34cc-mxv5-fmf4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:22.407809898Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:408b9946-322a-485a-a264-ab8f0dafffb3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-34cc-mxv5-fmf4","advisory_id":"408b9946-322a-485a-a264-ab8f0dafffb3","event_types":["advisory"],"published_at":"2026-10-25T22:53:45.034598+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/71536"}]}},{"id":71135,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-x75v-mjxf-973f","summary":"CGA-x75v-mjxf-973f","evidence":"osv:CGA-x75v-mjxf-973f","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x75v-mjxf-973f","aliases":["CGA-x75v-mjxf-973f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x75v-mjxf-973f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:19.461448960Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6134bf5b-d646-41b3-9b61-0a4f91398c8d","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x75v-mjxf-973f","advisory_id":"6134bf5b-d646-41b3-9b61-0a4f91398c8d","event_types":["advisory"],"published_at":"2026-10-25T22:52:27.697751+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:43+00:00","detail_url":"/advisories/advisory%3A6134bf5b-d646-41b3-9b61-0a4f91398c8d","group":{"id":"advisory:6134bf5b-d646-41b3-9b61-0a4f91398c8d","revision":1,"primary_event_id":71510,"change":"published","superseded_by":[],"changed":{"id":71510,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-x75v-mjxf-973f","summary":"CGA-x75v-mjxf-973f","evidence":"osv:CGA-x75v-mjxf-973f","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x75v-mjxf-973f","aliases":["CGA-x75v-mjxf-973f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x75v-mjxf-973f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:19.461448960Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6134bf5b-d646-41b3-9b61-0a4f91398c8d","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x75v-mjxf-973f","advisory_id":"6134bf5b-d646-41b3-9b61-0a4f91398c8d","event_types":["advisory"],"published_at":"2026-10-25T22:52:27.697751+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:43+00:00","detail_url":"/events/71510"},"members":[{"id":71510,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-x75v-mjxf-973f","summary":"CGA-x75v-mjxf-973f","evidence":"osv:CGA-x75v-mjxf-973f","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x75v-mjxf-973f","aliases":["CGA-x75v-mjxf-973f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x75v-mjxf-973f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:19.461448960Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6134bf5b-d646-41b3-9b61-0a4f91398c8d","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x75v-mjxf-973f","advisory_id":"6134bf5b-d646-41b3-9b61-0a4f91398c8d","event_types":["advisory"],"published_at":"2026-10-25T22:52:27.697751+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:43+00:00","detail_url":"/events/71510"}]}},{"id":71075,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2v2g-8w75-3prr","summary":"CGA-2v2g-8w75-3prr","evidence":"osv:CGA-2v2g-8w75-3prr","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v2g-8w75-3prr","aliases":["CGA-2v2g-8w75-3prr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v2g-8w75-3prr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:51Z"}]}}],"modified":"2026-10-02T23:00:13.436448191Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e919532-4e69-4bc7-8051-20f7b8b70d9d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v2g-8w75-3prr","advisory_id":"3e919532-4e69-4bc7-8051-20f7b8b70d9d","event_types":["advisory"],"published_at":"2026-10-25T22:49:30.554625+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/advisories/advisory%3A3e919532-4e69-4bc7-8051-20f7b8b70d9d","group":{"id":"advisory:3e919532-4e69-4bc7-8051-20f7b8b70d9d","revision":1,"primary_event_id":71449,"change":"published","superseded_by":[],"changed":{"id":71449,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2v2g-8w75-3prr","summary":"CGA-2v2g-8w75-3prr","evidence":"osv:CGA-2v2g-8w75-3prr","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v2g-8w75-3prr","aliases":["CGA-2v2g-8w75-3prr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v2g-8w75-3prr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:51Z"}]}}],"modified":"2026-10-02T23:00:13.436448191Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e919532-4e69-4bc7-8051-20f7b8b70d9d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v2g-8w75-3prr","advisory_id":"3e919532-4e69-4bc7-8051-20f7b8b70d9d","event_types":["advisory"],"published_at":"2026-10-25T22:49:30.554625+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/events/71449"},"members":[{"id":71449,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2v2g-8w75-3prr","summary":"CGA-2v2g-8w75-3prr","evidence":"osv:CGA-2v2g-8w75-3prr","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v2g-8w75-3prr","aliases":["CGA-2v2g-8w75-3prr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v2g-8w75-3prr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:51Z"}]}}],"modified":"2026-10-02T23:00:13.436448191Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e919532-4e69-4bc7-8051-20f7b8b70d9d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v2g-8w75-3prr","advisory_id":"3e919532-4e69-4bc7-8051-20f7b8b70d9d","event_types":["advisory"],"published_at":"2026-10-25T22:49:30.554625+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/events/71449"}]}},{"id":71073,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3j2g-c27g-w6c8","summary":"CGA-3j2g-c27g-w6c8","evidence":"osv:CGA-3j2g-c27g-w6c8","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3j2g-c27g-w6c8","aliases":["CGA-3j2g-c27g-w6c8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3j2g-c27g-w6c8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:00:12.972473986Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3j2g-c27g-w6c8","advisory_id":"78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","event_types":["advisory"],"published_at":"2026-10-25T22:49:26.919584+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/advisories/advisory%3A78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","group":{"id":"advisory:78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","revision":1,"primary_event_id":71447,"change":"published","superseded_by":[],"changed":{"id":71447,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3j2g-c27g-w6c8","summary":"CGA-3j2g-c27g-w6c8","evidence":"osv:CGA-3j2g-c27g-w6c8","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3j2g-c27g-w6c8","aliases":["CGA-3j2g-c27g-w6c8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3j2g-c27g-w6c8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:00:12.972473986Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3j2g-c27g-w6c8","advisory_id":"78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","event_types":["advisory"],"published_at":"2026-10-25T22:49:26.919584+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/events/71447"},"members":[{"id":71447,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3j2g-c27g-w6c8","summary":"CGA-3j2g-c27g-w6c8","evidence":"osv:CGA-3j2g-c27g-w6c8","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3j2g-c27g-w6c8","aliases":["CGA-3j2g-c27g-w6c8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3j2g-c27g-w6c8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:00:12.972473986Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3j2g-c27g-w6c8","advisory_id":"78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","event_types":["advisory"],"published_at":"2026-10-25T22:49:26.919584+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/events/71447"}]}},{"id":71058,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-phrg-p9v9-f4mx","summary":"CGA-phrg-p9v9-f4mx","evidence":"osv:CGA-phrg-p9v9-f4mx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-phrg-p9v9-f4mx","aliases":["CGA-phrg-p9v9-f4mx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-phrg-p9v9-f4mx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.057858719Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-phrg-p9v9-f4mx","advisory_id":"dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","event_types":["advisory"],"published_at":"2026-10-25T22:48:56.625967+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/advisories/advisory%3Adbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","group":{"id":"advisory:dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","revision":1,"primary_event_id":71432,"change":"published","superseded_by":[],"changed":{"id":71432,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-phrg-p9v9-f4mx","summary":"CGA-phrg-p9v9-f4mx","evidence":"osv:CGA-phrg-p9v9-f4mx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-phrg-p9v9-f4mx","aliases":["CGA-phrg-p9v9-f4mx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-phrg-p9v9-f4mx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.057858719Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-phrg-p9v9-f4mx","advisory_id":"dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","event_types":["advisory"],"published_at":"2026-10-25T22:48:56.625967+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/71432"},"members":[{"id":71432,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-phrg-p9v9-f4mx","summary":"CGA-phrg-p9v9-f4mx","evidence":"osv:CGA-phrg-p9v9-f4mx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-phrg-p9v9-f4mx","aliases":["CGA-phrg-p9v9-f4mx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-phrg-p9v9-f4mx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.057858719Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-phrg-p9v9-f4mx","advisory_id":"dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","event_types":["advisory"],"published_at":"2026-10-25T22:48:56.625967+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/71432"}]}}],"next_after":72058,"next_before":71058}