{"schema_version":"2","view":"grouped","data":[{"id":72040,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-wrcj-xxph-923f","summary":"CGA-wrcj-xxph-923f","evidence":"osv:CGA-wrcj-xxph-923f","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wrcj-xxph-923f","aliases":["CGA-wrcj-xxph-923f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrcj-xxph-923f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:08Z"}]}}],"modified":"2026-10-02T23:01:54.080362948Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:502b44f1-58d8-4e2e-ad96-3cd00e8dd4ff","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrcj-xxph-923f","advisory_id":"502b44f1-58d8-4e2e-ad96-3cd00e8dd4ff","event_types":["advisory"],"published_at":"2026-10-26T00:12:27.616215+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:30+00:00","detail_url":"/advisories/advisory%3A502b44f1-58d8-4e2e-ad96-3cd00e8dd4ff","group":{"id":"advisory:502b44f1-58d8-4e2e-ad96-3cd00e8dd4ff","revision":1,"primary_event_id":72662,"change":"published","superseded_by":[],"changed":{"id":72662,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-wrcj-xxph-923f","summary":"CGA-wrcj-xxph-923f","evidence":"osv:CGA-wrcj-xxph-923f","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wrcj-xxph-923f","aliases":["CGA-wrcj-xxph-923f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrcj-xxph-923f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:08Z"}]}}],"modified":"2026-10-02T23:01:54.080362948Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:502b44f1-58d8-4e2e-ad96-3cd00e8dd4ff","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrcj-xxph-923f","advisory_id":"502b44f1-58d8-4e2e-ad96-3cd00e8dd4ff","event_types":["advisory"],"published_at":"2026-10-26T00:12:27.616215+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:30+00:00","detail_url":"/events/72662"},"members":[{"id":72662,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-wrcj-xxph-923f","summary":"CGA-wrcj-xxph-923f","evidence":"osv:CGA-wrcj-xxph-923f","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wrcj-xxph-923f","aliases":["CGA-wrcj-xxph-923f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrcj-xxph-923f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:08Z"}]}}],"modified":"2026-10-02T23:01:54.080362948Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:502b44f1-58d8-4e2e-ad96-3cd00e8dd4ff","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrcj-xxph-923f","advisory_id":"502b44f1-58d8-4e2e-ad96-3cd00e8dd4ff","event_types":["advisory"],"published_at":"2026-10-26T00:12:27.616215+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:30+00:00","detail_url":"/events/72662"}]}},{"id":72034,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-wqhc-jv98-jf3f","summary":"CGA-wqhc-jv98-jf3f","evidence":"osv:CGA-wqhc-jv98-jf3f","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wqhc-jv98-jf3f","aliases":["CGA-wqhc-jv98-jf3f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqhc-jv98-jf3f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:13Z"}]}}],"modified":"2026-10-02T23:01:54.731103273Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dfc5f347-e658-4ffb-b2b9-ef6f2ceb2140","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wqhc-jv98-jf3f","advisory_id":"dfc5f347-e658-4ffb-b2b9-ef6f2ceb2140","event_types":["advisory"],"published_at":"2026-10-26T00:11:57.053963+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:58+00:00","detail_url":"/advisories/advisory%3Adfc5f347-e658-4ffb-b2b9-ef6f2ceb2140","group":{"id":"advisory:dfc5f347-e658-4ffb-b2b9-ef6f2ceb2140","revision":1,"primary_event_id":72656,"change":"published","superseded_by":[],"changed":{"id":72656,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-wqhc-jv98-jf3f","summary":"CGA-wqhc-jv98-jf3f","evidence":"osv:CGA-wqhc-jv98-jf3f","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wqhc-jv98-jf3f","aliases":["CGA-wqhc-jv98-jf3f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqhc-jv98-jf3f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:13Z"}]}}],"modified":"2026-10-02T23:01:54.731103273Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dfc5f347-e658-4ffb-b2b9-ef6f2ceb2140","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wqhc-jv98-jf3f","advisory_id":"dfc5f347-e658-4ffb-b2b9-ef6f2ceb2140","event_types":["advisory"],"published_at":"2026-10-26T00:11:57.053963+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:58+00:00","detail_url":"/events/72656"},"members":[{"id":72656,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-wqhc-jv98-jf3f","summary":"CGA-wqhc-jv98-jf3f","evidence":"osv:CGA-wqhc-jv98-jf3f","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wqhc-jv98-jf3f","aliases":["CGA-wqhc-jv98-jf3f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqhc-jv98-jf3f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:13Z"}]}}],"modified":"2026-10-02T23:01:54.731103273Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dfc5f347-e658-4ffb-b2b9-ef6f2ceb2140","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wqhc-jv98-jf3f","advisory_id":"dfc5f347-e658-4ffb-b2b9-ef6f2ceb2140","event_types":["advisory"],"published_at":"2026-10-26T00:11:57.053963+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:58+00:00","detail_url":"/events/72656"}]}},{"id":72017,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-w83g-mwrv-j892","summary":"CGA-w83g-mwrv-j892","evidence":"osv:CGA-w83g-mwrv-j892","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w83g-mwrv-j892","aliases":["CGA-w83g-mwrv-j892"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w83g-mwrv-j892.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:10Z"}]}}],"modified":"2026-10-02T23:01:49.274718454Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:53c333bb-8634-4e09-92f1-5f4343d52a93","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w83g-mwrv-j892","advisory_id":"53c333bb-8634-4e09-92f1-5f4343d52a93","event_types":["advisory"],"published_at":"2026-10-26T00:09:29.013297+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:56+00:00","detail_url":"/advisories/advisory%3A53c333bb-8634-4e09-92f1-5f4343d52a93","group":{"id":"advisory:53c333bb-8634-4e09-92f1-5f4343d52a93","revision":1,"primary_event_id":72619,"change":"published","superseded_by":[],"changed":{"id":72619,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-w83g-mwrv-j892","summary":"CGA-w83g-mwrv-j892","evidence":"osv:CGA-w83g-mwrv-j892","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w83g-mwrv-j892","aliases":["CGA-w83g-mwrv-j892"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w83g-mwrv-j892.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:10Z"}]}}],"modified":"2026-10-02T23:01:49.274718454Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:53c333bb-8634-4e09-92f1-5f4343d52a93","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w83g-mwrv-j892","advisory_id":"53c333bb-8634-4e09-92f1-5f4343d52a93","event_types":["advisory"],"published_at":"2026-10-26T00:09:29.013297+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:56+00:00","detail_url":"/events/72619"},"members":[{"id":72619,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-w83g-mwrv-j892","summary":"CGA-w83g-mwrv-j892","evidence":"osv:CGA-w83g-mwrv-j892","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w83g-mwrv-j892","aliases":["CGA-w83g-mwrv-j892"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w83g-mwrv-j892.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:10Z"}]}}],"modified":"2026-10-02T23:01:49.274718454Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:53c333bb-8634-4e09-92f1-5f4343d52a93","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w83g-mwrv-j892","advisory_id":"53c333bb-8634-4e09-92f1-5f4343d52a93","event_types":["advisory"],"published_at":"2026-10-26T00:09:29.013297+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:56+00:00","detail_url":"/events/72619"}]}},{"id":71931,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-qc2c-j748-c988","summary":"CGA-qc2c-j748-c988","evidence":"osv:CGA-qc2c-j748-c988","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-qc2c-j748-c988","aliases":["CGA-qc2c-j748-c988"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qc2c-j748-c988.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:09Z"}]}}],"modified":"2026-10-02T23:01:42.596831323Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ce1ae1bd-b030-4136-8961-ecda8fabd428","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qc2c-j748-c988","advisory_id":"ce1ae1bd-b030-4136-8961-ecda8fabd428","event_types":["advisory"],"published_at":"2026-10-25T23:56:45.825196+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:56+00:00","detail_url":"/advisories/advisory%3Ace1ae1bd-b030-4136-8961-ecda8fabd428","group":{"id":"advisory:ce1ae1bd-b030-4136-8961-ecda8fabd428","revision":1,"primary_event_id":72475,"change":"published","superseded_by":[],"changed":{"id":72475,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-qc2c-j748-c988","summary":"CGA-qc2c-j748-c988","evidence":"osv:CGA-qc2c-j748-c988","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-qc2c-j748-c988","aliases":["CGA-qc2c-j748-c988"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qc2c-j748-c988.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:09Z"}]}}],"modified":"2026-10-02T23:01:42.596831323Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ce1ae1bd-b030-4136-8961-ecda8fabd428","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qc2c-j748-c988","advisory_id":"ce1ae1bd-b030-4136-8961-ecda8fabd428","event_types":["advisory"],"published_at":"2026-10-25T23:56:45.825196+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:56+00:00","detail_url":"/events/72475"},"members":[{"id":72475,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-qc2c-j748-c988","summary":"CGA-qc2c-j748-c988","evidence":"osv:CGA-qc2c-j748-c988","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-qc2c-j748-c988","aliases":["CGA-qc2c-j748-c988"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qc2c-j748-c988.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:09Z"}]}}],"modified":"2026-10-02T23:01:42.596831323Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ce1ae1bd-b030-4136-8961-ecda8fabd428","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qc2c-j748-c988","advisory_id":"ce1ae1bd-b030-4136-8961-ecda8fabd428","event_types":["advisory"],"published_at":"2026-10-25T23:56:45.825196+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:56+00:00","detail_url":"/events/72475"}]}},{"id":71902,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-mfx9-85pp-4r79","summary":"CGA-mfx9-85pp-4r79","evidence":"osv:CGA-mfx9-85pp-4r79","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mfx9-85pp-4r79","aliases":["CGA-mfx9-85pp-4r79"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mfx9-85pp-4r79.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:11Z"}]}}],"modified":"2026-10-02T23:01:39.544670239Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7d3b94a-ab1a-48d0-89ea-726a079958cc","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mfx9-85pp-4r79","advisory_id":"e7d3b94a-ab1a-48d0-89ea-726a079958cc","event_types":["advisory"],"published_at":"2026-10-25T23:49:35.996627+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:30+00:00","detail_url":"/advisories/advisory%3Ae7d3b94a-ab1a-48d0-89ea-726a079958cc","group":{"id":"advisory:e7d3b94a-ab1a-48d0-89ea-726a079958cc","revision":1,"primary_event_id":72418,"change":"published","superseded_by":[],"changed":{"id":72418,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-mfx9-85pp-4r79","summary":"CGA-mfx9-85pp-4r79","evidence":"osv:CGA-mfx9-85pp-4r79","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mfx9-85pp-4r79","aliases":["CGA-mfx9-85pp-4r79"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mfx9-85pp-4r79.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:11Z"}]}}],"modified":"2026-10-02T23:01:39.544670239Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7d3b94a-ab1a-48d0-89ea-726a079958cc","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mfx9-85pp-4r79","advisory_id":"e7d3b94a-ab1a-48d0-89ea-726a079958cc","event_types":["advisory"],"published_at":"2026-10-25T23:49:35.996627+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:30+00:00","detail_url":"/events/72418"},"members":[{"id":72418,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-mfx9-85pp-4r79","summary":"CGA-mfx9-85pp-4r79","evidence":"osv:CGA-mfx9-85pp-4r79","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mfx9-85pp-4r79","aliases":["CGA-mfx9-85pp-4r79"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mfx9-85pp-4r79.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:11Z"}]}}],"modified":"2026-10-02T23:01:39.544670239Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7d3b94a-ab1a-48d0-89ea-726a079958cc","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mfx9-85pp-4r79","advisory_id":"e7d3b94a-ab1a-48d0-89ea-726a079958cc","event_types":["advisory"],"published_at":"2026-10-25T23:49:35.996627+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:30+00:00","detail_url":"/events/72418"}]}},{"id":71855,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-g5f5-46m3-x7xr","summary":"CGA-g5f5-46m3-x7xr","evidence":"osv:CGA-g5f5-46m3-x7xr","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g5f5-46m3-x7xr","aliases":["CGA-g5f5-46m3-x7xr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5f5-46m3-x7xr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:11Z"}]}}],"modified":"2026-10-02T23:01:31.833319801Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:175477f3-5189-4ba6-86b2-02282cbffda7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g5f5-46m3-x7xr","advisory_id":"175477f3-5189-4ba6-86b2-02282cbffda7","event_types":["advisory"],"published_at":"2026-10-25T23:44:31.783034+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/advisories/advisory%3A175477f3-5189-4ba6-86b2-02282cbffda7","group":{"id":"advisory:175477f3-5189-4ba6-86b2-02282cbffda7","revision":1,"primary_event_id":72349,"change":"published","superseded_by":[],"changed":{"id":72349,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-g5f5-46m3-x7xr","summary":"CGA-g5f5-46m3-x7xr","evidence":"osv:CGA-g5f5-46m3-x7xr","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g5f5-46m3-x7xr","aliases":["CGA-g5f5-46m3-x7xr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5f5-46m3-x7xr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:11Z"}]}}],"modified":"2026-10-02T23:01:31.833319801Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:175477f3-5189-4ba6-86b2-02282cbffda7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g5f5-46m3-x7xr","advisory_id":"175477f3-5189-4ba6-86b2-02282cbffda7","event_types":["advisory"],"published_at":"2026-10-25T23:44:31.783034+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/events/72349"},"members":[{"id":72349,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-g5f5-46m3-x7xr","summary":"CGA-g5f5-46m3-x7xr","evidence":"osv:CGA-g5f5-46m3-x7xr","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g5f5-46m3-x7xr","aliases":["CGA-g5f5-46m3-x7xr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5f5-46m3-x7xr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:11Z"}]}}],"modified":"2026-10-02T23:01:31.833319801Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:175477f3-5189-4ba6-86b2-02282cbffda7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g5f5-46m3-x7xr","advisory_id":"175477f3-5189-4ba6-86b2-02282cbffda7","event_types":["advisory"],"published_at":"2026-10-25T23:44:31.783034+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/events/72349"}]}},{"id":71839,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-f2pq-j29m-gm3r","summary":"CGA-f2pq-j29m-gm3r","evidence":"osv:CGA-f2pq-j29m-gm3r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-f2pq-j29m-gm3r","aliases":["CGA-f2pq-j29m-gm3r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f2pq-j29m-gm3r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:15Z"}]}}],"modified":"2026-10-02T23:01:30.345141786Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:724884e4-7fcc-41f1-8b68-1d815d283188","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f2pq-j29m-gm3r","advisory_id":"724884e4-7fcc-41f1-8b68-1d815d283188","event_types":["advisory"],"published_at":"2026-10-25T23:42:59.168094+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:54+00:00","detail_url":"/advisories/advisory%3A724884e4-7fcc-41f1-8b68-1d815d283188","group":{"id":"advisory:724884e4-7fcc-41f1-8b68-1d815d283188","revision":1,"primary_event_id":72324,"change":"published","superseded_by":[],"changed":{"id":72324,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-f2pq-j29m-gm3r","summary":"CGA-f2pq-j29m-gm3r","evidence":"osv:CGA-f2pq-j29m-gm3r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-f2pq-j29m-gm3r","aliases":["CGA-f2pq-j29m-gm3r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f2pq-j29m-gm3r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:15Z"}]}}],"modified":"2026-10-02T23:01:30.345141786Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:724884e4-7fcc-41f1-8b68-1d815d283188","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f2pq-j29m-gm3r","advisory_id":"724884e4-7fcc-41f1-8b68-1d815d283188","event_types":["advisory"],"published_at":"2026-10-25T23:42:59.168094+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:54+00:00","detail_url":"/events/72324"},"members":[{"id":72324,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-f2pq-j29m-gm3r","summary":"CGA-f2pq-j29m-gm3r","evidence":"osv:CGA-f2pq-j29m-gm3r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-f2pq-j29m-gm3r","aliases":["CGA-f2pq-j29m-gm3r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f2pq-j29m-gm3r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:15Z"}]}}],"modified":"2026-10-02T23:01:30.345141786Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:724884e4-7fcc-41f1-8b68-1d815d283188","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f2pq-j29m-gm3r","advisory_id":"724884e4-7fcc-41f1-8b68-1d815d283188","event_types":["advisory"],"published_at":"2026-10-25T23:42:59.168094+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:54+00:00","detail_url":"/events/72324"}]}},{"id":71797,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-8v2x-54x9-jxwv","summary":"CGA-8v2x-54x9-jxwv","evidence":"osv:CGA-8v2x-54x9-jxwv","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8v2x-54x9-jxwv","aliases":["CGA-8v2x-54x9-jxwv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8v2x-54x9-jxwv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:12Z"}]}}],"modified":"2026-10-02T23:01:28.576378361Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:aa5e7929-d33d-4d8d-b70e-c398d2812b36","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8v2x-54x9-jxwv","advisory_id":"aa5e7929-d33d-4d8d-b70e-c398d2812b36","event_types":["advisory"],"published_at":"2026-10-25T23:38:49.364079+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:33+00:00","detail_url":"/advisories/advisory%3Aaa5e7929-d33d-4d8d-b70e-c398d2812b36","group":{"id":"advisory:aa5e7929-d33d-4d8d-b70e-c398d2812b36","revision":1,"primary_event_id":72266,"change":"published","superseded_by":[],"changed":{"id":72266,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-8v2x-54x9-jxwv","summary":"CGA-8v2x-54x9-jxwv","evidence":"osv:CGA-8v2x-54x9-jxwv","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8v2x-54x9-jxwv","aliases":["CGA-8v2x-54x9-jxwv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8v2x-54x9-jxwv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:12Z"}]}}],"modified":"2026-10-02T23:01:28.576378361Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:aa5e7929-d33d-4d8d-b70e-c398d2812b36","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8v2x-54x9-jxwv","advisory_id":"aa5e7929-d33d-4d8d-b70e-c398d2812b36","event_types":["advisory"],"published_at":"2026-10-25T23:38:49.364079+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:33+00:00","detail_url":"/events/72266"},"members":[{"id":72266,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-8v2x-54x9-jxwv","summary":"CGA-8v2x-54x9-jxwv","evidence":"osv:CGA-8v2x-54x9-jxwv","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8v2x-54x9-jxwv","aliases":["CGA-8v2x-54x9-jxwv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8v2x-54x9-jxwv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:12Z"}]}}],"modified":"2026-10-02T23:01:28.576378361Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:aa5e7929-d33d-4d8d-b70e-c398d2812b36","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8v2x-54x9-jxwv","advisory_id":"aa5e7929-d33d-4d8d-b70e-c398d2812b36","event_types":["advisory"],"published_at":"2026-10-25T23:38:49.364079+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:33+00:00","detail_url":"/events/72266"}]}},{"id":71757,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-65qf-pj59-w9xw","summary":"CGA-65qf-pj59-w9xw","evidence":"osv:CGA-65qf-pj59-w9xw","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-65qf-pj59-w9xw","aliases":["CGA-65qf-pj59-w9xw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65qf-pj59-w9xw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:14Z"}]}}],"modified":"2026-10-02T23:01:24.422758180Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4edacf91-a26e-4a34-b5be-ef4b35a4e6ee","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-65qf-pj59-w9xw","advisory_id":"4edacf91-a26e-4a34-b5be-ef4b35a4e6ee","event_types":["advisory"],"published_at":"2026-10-25T23:35:04.432619+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/advisories/advisory%3A4edacf91-a26e-4a34-b5be-ef4b35a4e6ee","group":{"id":"advisory:4edacf91-a26e-4a34-b5be-ef4b35a4e6ee","revision":1,"primary_event_id":72208,"change":"published","superseded_by":[],"changed":{"id":72208,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-65qf-pj59-w9xw","summary":"CGA-65qf-pj59-w9xw","evidence":"osv:CGA-65qf-pj59-w9xw","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-65qf-pj59-w9xw","aliases":["CGA-65qf-pj59-w9xw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65qf-pj59-w9xw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:14Z"}]}}],"modified":"2026-10-02T23:01:24.422758180Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4edacf91-a26e-4a34-b5be-ef4b35a4e6ee","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-65qf-pj59-w9xw","advisory_id":"4edacf91-a26e-4a34-b5be-ef4b35a4e6ee","event_types":["advisory"],"published_at":"2026-10-25T23:35:04.432619+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/events/72208"},"members":[{"id":72208,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-65qf-pj59-w9xw","summary":"CGA-65qf-pj59-w9xw","evidence":"osv:CGA-65qf-pj59-w9xw","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-65qf-pj59-w9xw","aliases":["CGA-65qf-pj59-w9xw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65qf-pj59-w9xw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:14Z"}]}}],"modified":"2026-10-02T23:01:24.422758180Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4edacf91-a26e-4a34-b5be-ef4b35a4e6ee","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-65qf-pj59-w9xw","advisory_id":"4edacf91-a26e-4a34-b5be-ef4b35a4e6ee","event_types":["advisory"],"published_at":"2026-10-25T23:35:04.432619+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/events/72208"}]}},{"id":71754,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-674h-6w7j-hf75","summary":"CGA-674h-6w7j-hf75","evidence":"osv:CGA-674h-6w7j-hf75","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-674h-6w7j-hf75","aliases":["CGA-674h-6w7j-hf75"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-674h-6w7j-hf75.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:12Z"}]}}],"modified":"2026-10-02T23:01:24.205887939Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:aaf68133-45b4-4958-9006-e7b67bc0312e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-674h-6w7j-hf75","advisory_id":"aaf68133-45b4-4958-9006-e7b67bc0312e","event_types":["advisory"],"published_at":"2026-10-25T23:34:46.609236+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:53+00:00","detail_url":"/advisories/advisory%3Aaaf68133-45b4-4958-9006-e7b67bc0312e","group":{"id":"advisory:aaf68133-45b4-4958-9006-e7b67bc0312e","revision":1,"primary_event_id":72203,"change":"published","superseded_by":[],"changed":{"id":72203,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-674h-6w7j-hf75","summary":"CGA-674h-6w7j-hf75","evidence":"osv:CGA-674h-6w7j-hf75","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-674h-6w7j-hf75","aliases":["CGA-674h-6w7j-hf75"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-674h-6w7j-hf75.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:12Z"}]}}],"modified":"2026-10-02T23:01:24.205887939Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:aaf68133-45b4-4958-9006-e7b67bc0312e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-674h-6w7j-hf75","advisory_id":"aaf68133-45b4-4958-9006-e7b67bc0312e","event_types":["advisory"],"published_at":"2026-10-25T23:34:46.609236+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:53+00:00","detail_url":"/events/72203"},"members":[{"id":72203,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-674h-6w7j-hf75","summary":"CGA-674h-6w7j-hf75","evidence":"osv:CGA-674h-6w7j-hf75","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-674h-6w7j-hf75","aliases":["CGA-674h-6w7j-hf75"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-674h-6w7j-hf75.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:12Z"}]}}],"modified":"2026-10-02T23:01:24.205887939Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:aaf68133-45b4-4958-9006-e7b67bc0312e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-674h-6w7j-hf75","advisory_id":"aaf68133-45b4-4958-9006-e7b67bc0312e","event_types":["advisory"],"published_at":"2026-10-25T23:34:46.609236+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:53+00:00","detail_url":"/events/72203"}]}},{"id":71738,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-4g8q-2prm-9rmq","summary":"CGA-4g8q-2prm-9rmq","evidence":"osv:CGA-4g8q-2prm-9rmq","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4g8q-2prm-9rmq","aliases":["CGA-4g8q-2prm-9rmq"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4g8q-2prm-9rmq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:10Z"}]}}],"modified":"2026-10-02T23:01:22.163889044Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:808cb698-7b5a-4097-9ace-96a873919edd","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4g8q-2prm-9rmq","advisory_id":"808cb698-7b5a-4097-9ace-96a873919edd","event_types":["advisory"],"published_at":"2026-10-25T23:33:37.877041+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:31+00:00","detail_url":"/advisories/advisory%3A808cb698-7b5a-4097-9ace-96a873919edd","group":{"id":"advisory:808cb698-7b5a-4097-9ace-96a873919edd","revision":1,"primary_event_id":72183,"change":"published","superseded_by":[],"changed":{"id":72183,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-4g8q-2prm-9rmq","summary":"CGA-4g8q-2prm-9rmq","evidence":"osv:CGA-4g8q-2prm-9rmq","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4g8q-2prm-9rmq","aliases":["CGA-4g8q-2prm-9rmq"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4g8q-2prm-9rmq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:10Z"}]}}],"modified":"2026-10-02T23:01:22.163889044Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:808cb698-7b5a-4097-9ace-96a873919edd","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4g8q-2prm-9rmq","advisory_id":"808cb698-7b5a-4097-9ace-96a873919edd","event_types":["advisory"],"published_at":"2026-10-25T23:33:37.877041+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:31+00:00","detail_url":"/events/72183"},"members":[{"id":72183,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-4g8q-2prm-9rmq","summary":"CGA-4g8q-2prm-9rmq","evidence":"osv:CGA-4g8q-2prm-9rmq","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4g8q-2prm-9rmq","aliases":["CGA-4g8q-2prm-9rmq"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4g8q-2prm-9rmq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:10Z"}]}}],"modified":"2026-10-02T23:01:22.163889044Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:808cb698-7b5a-4097-9ace-96a873919edd","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4g8q-2prm-9rmq","advisory_id":"808cb698-7b5a-4097-9ace-96a873919edd","event_types":["advisory"],"published_at":"2026-10-25T23:33:37.877041+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:31+00:00","detail_url":"/events/72183"}]}},{"id":71674,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-5qc3-qcc3-45xm","summary":"CGA-5qc3-qcc3-45xm","evidence":"osv:CGA-5qc3-qcc3-45xm","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5qc3-qcc3-45xm","aliases":["CGA-5qc3-qcc3-45xm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5qc3-qcc3-45xm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:14Z"}]}}],"modified":"2026-10-02T23:01:16.543088263Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:837fc3ed-8fae-4b65-b037-14f79c983654","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5qc3-qcc3-45xm","advisory_id":"837fc3ed-8fae-4b65-b037-14f79c983654","event_types":["advisory"],"published_at":"2026-10-25T23:28:12.923497+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:55+00:00","detail_url":"/advisories/advisory%3A837fc3ed-8fae-4b65-b037-14f79c983654","group":{"id":"advisory:837fc3ed-8fae-4b65-b037-14f79c983654","revision":1,"primary_event_id":72112,"change":"published","superseded_by":[],"changed":{"id":72112,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-5qc3-qcc3-45xm","summary":"CGA-5qc3-qcc3-45xm","evidence":"osv:CGA-5qc3-qcc3-45xm","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5qc3-qcc3-45xm","aliases":["CGA-5qc3-qcc3-45xm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5qc3-qcc3-45xm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:14Z"}]}}],"modified":"2026-10-02T23:01:16.543088263Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:837fc3ed-8fae-4b65-b037-14f79c983654","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5qc3-qcc3-45xm","advisory_id":"837fc3ed-8fae-4b65-b037-14f79c983654","event_types":["advisory"],"published_at":"2026-10-25T23:28:12.923497+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:55+00:00","detail_url":"/events/72112"},"members":[{"id":72112,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-5qc3-qcc3-45xm","summary":"CGA-5qc3-qcc3-45xm","evidence":"osv:CGA-5qc3-qcc3-45xm","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5qc3-qcc3-45xm","aliases":["CGA-5qc3-qcc3-45xm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5qc3-qcc3-45xm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:14Z"}]}}],"modified":"2026-10-02T23:01:16.543088263Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:837fc3ed-8fae-4b65-b037-14f79c983654","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5qc3-qcc3-45xm","advisory_id":"837fc3ed-8fae-4b65-b037-14f79c983654","event_types":["advisory"],"published_at":"2026-10-25T23:28:12.923497+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:55+00:00","detail_url":"/events/72112"}]}},{"id":71623,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-w68v-jmw8-v99j","summary":"CGA-w68v-jmw8-v99j","evidence":"osv:CGA-w68v-jmw8-v99j","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w68v-jmw8-v99j","aliases":["CGA-w68v-jmw8-v99j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w68v-jmw8-v99j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:10Z"}]}}],"modified":"2026-10-02T23:01:11.576146049Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b5be11c3-f5ba-4a25-8236-8c2c5b6d3ac9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w68v-jmw8-v99j","advisory_id":"b5be11c3-f5ba-4a25-8236-8c2c5b6d3ac9","event_types":["advisory"],"published_at":"2026-10-25T23:23:43.587097+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:33+00:00","detail_url":"/advisories/advisory%3Ab5be11c3-f5ba-4a25-8236-8c2c5b6d3ac9","group":{"id":"advisory:b5be11c3-f5ba-4a25-8236-8c2c5b6d3ac9","revision":1,"primary_event_id":72049,"change":"published","superseded_by":[],"changed":{"id":72049,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-w68v-jmw8-v99j","summary":"CGA-w68v-jmw8-v99j","evidence":"osv:CGA-w68v-jmw8-v99j","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w68v-jmw8-v99j","aliases":["CGA-w68v-jmw8-v99j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w68v-jmw8-v99j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:10Z"}]}}],"modified":"2026-10-02T23:01:11.576146049Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b5be11c3-f5ba-4a25-8236-8c2c5b6d3ac9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w68v-jmw8-v99j","advisory_id":"b5be11c3-f5ba-4a25-8236-8c2c5b6d3ac9","event_types":["advisory"],"published_at":"2026-10-25T23:23:43.587097+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:33+00:00","detail_url":"/events/72049"},"members":[{"id":72049,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-w68v-jmw8-v99j","summary":"CGA-w68v-jmw8-v99j","evidence":"osv:CGA-w68v-jmw8-v99j","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w68v-jmw8-v99j","aliases":["CGA-w68v-jmw8-v99j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w68v-jmw8-v99j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:10Z"}]}}],"modified":"2026-10-02T23:01:11.576146049Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b5be11c3-f5ba-4a25-8236-8c2c5b6d3ac9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w68v-jmw8-v99j","advisory_id":"b5be11c3-f5ba-4a25-8236-8c2c5b6d3ac9","event_types":["advisory"],"published_at":"2026-10-25T23:23:43.587097+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:33+00:00","detail_url":"/events/72049"}]}},{"id":71564,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-wqvh-c555-cf3q","summary":"CGA-wqvh-c555-cf3q","evidence":"osv:CGA-wqvh-c555-cf3q","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wqvh-c555-cf3q","aliases":["CGA-wqvh-c555-cf3q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqvh-c555-cf3q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:13Z"}]}}],"modified":"2026-10-02T23:01:05.427553920Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e0453f59-da86-4c59-8fed-dd5c07b27558","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wqvh-c555-cf3q","advisory_id":"e0453f59-da86-4c59-8fed-dd5c07b27558","event_types":["advisory"],"published_at":"2026-10-25T23:19:34.754231+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/advisories/advisory%3Ae0453f59-da86-4c59-8fed-dd5c07b27558","group":{"id":"advisory:e0453f59-da86-4c59-8fed-dd5c07b27558","revision":1,"primary_event_id":71980,"change":"published","superseded_by":[],"changed":{"id":71980,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-wqvh-c555-cf3q","summary":"CGA-wqvh-c555-cf3q","evidence":"osv:CGA-wqvh-c555-cf3q","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wqvh-c555-cf3q","aliases":["CGA-wqvh-c555-cf3q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqvh-c555-cf3q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:13Z"}]}}],"modified":"2026-10-02T23:01:05.427553920Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e0453f59-da86-4c59-8fed-dd5c07b27558","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wqvh-c555-cf3q","advisory_id":"e0453f59-da86-4c59-8fed-dd5c07b27558","event_types":["advisory"],"published_at":"2026-10-25T23:19:34.754231+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/events/71980"},"members":[{"id":71980,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-wqvh-c555-cf3q","summary":"CGA-wqvh-c555-cf3q","evidence":"osv:CGA-wqvh-c555-cf3q","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wqvh-c555-cf3q","aliases":["CGA-wqvh-c555-cf3q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqvh-c555-cf3q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:13Z"}]}}],"modified":"2026-10-02T23:01:05.427553920Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e0453f59-da86-4c59-8fed-dd5c07b27558","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wqvh-c555-cf3q","advisory_id":"e0453f59-da86-4c59-8fed-dd5c07b27558","event_types":["advisory"],"published_at":"2026-10-25T23:19:34.754231+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/events/71980"}]}},{"id":71556,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-vf8m-g8r5-hffm","summary":"CGA-vf8m-g8r5-hffm","evidence":"osv:CGA-vf8m-g8r5-hffm","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vf8m-g8r5-hffm","aliases":["CGA-vf8m-g8r5-hffm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vf8m-g8r5-hffm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:14Z"}]}}],"modified":"2026-10-02T23:01:04.914331414Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5fc89fd8-a244-4924-bfa3-bb34c1f4cf1d","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vf8m-g8r5-hffm","advisory_id":"5fc89fd8-a244-4924-bfa3-bb34c1f4cf1d","event_types":["advisory"],"published_at":"2026-10-25T23:19:06.879891+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:32+00:00","detail_url":"/advisories/advisory%3A5fc89fd8-a244-4924-bfa3-bb34c1f4cf1d","group":{"id":"advisory:5fc89fd8-a244-4924-bfa3-bb34c1f4cf1d","revision":1,"primary_event_id":71971,"change":"published","superseded_by":[],"changed":{"id":71971,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-vf8m-g8r5-hffm","summary":"CGA-vf8m-g8r5-hffm","evidence":"osv:CGA-vf8m-g8r5-hffm","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vf8m-g8r5-hffm","aliases":["CGA-vf8m-g8r5-hffm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vf8m-g8r5-hffm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:14Z"}]}}],"modified":"2026-10-02T23:01:04.914331414Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5fc89fd8-a244-4924-bfa3-bb34c1f4cf1d","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vf8m-g8r5-hffm","advisory_id":"5fc89fd8-a244-4924-bfa3-bb34c1f4cf1d","event_types":["advisory"],"published_at":"2026-10-25T23:19:06.879891+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:32+00:00","detail_url":"/events/71971"},"members":[{"id":71971,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-vf8m-g8r5-hffm","summary":"CGA-vf8m-g8r5-hffm","evidence":"osv:CGA-vf8m-g8r5-hffm","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vf8m-g8r5-hffm","aliases":["CGA-vf8m-g8r5-hffm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vf8m-g8r5-hffm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:14Z"}]}}],"modified":"2026-10-02T23:01:04.914331414Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5fc89fd8-a244-4924-bfa3-bb34c1f4cf1d","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vf8m-g8r5-hffm","advisory_id":"5fc89fd8-a244-4924-bfa3-bb34c1f4cf1d","event_types":["advisory"],"published_at":"2026-10-25T23:19:06.879891+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:32+00:00","detail_url":"/events/71971"}]}},{"id":71489,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-p8p2-gj68-wqjm","summary":"CGA-p8p2-gj68-wqjm","evidence":"osv:CGA-p8p2-gj68-wqjm","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p8p2-gj68-wqjm","aliases":["CGA-p8p2-gj68-wqjm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p8p2-gj68-wqjm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:10Z"}]}}],"modified":"2026-10-02T23:00:53.988755356Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b8c50ce3-4d67-4e4e-b7c6-c7d0cb1e5625","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p8p2-gj68-wqjm","advisory_id":"b8c50ce3-4d67-4e4e-b7c6-c7d0cb1e5625","event_types":["advisory"],"published_at":"2026-10-25T23:14:00.771079+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:29+00:00","detail_url":"/advisories/advisory%3Ab8c50ce3-4d67-4e4e-b7c6-c7d0cb1e5625","group":{"id":"advisory:b8c50ce3-4d67-4e4e-b7c6-c7d0cb1e5625","revision":1,"primary_event_id":71896,"change":"published","superseded_by":[],"changed":{"id":71896,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-p8p2-gj68-wqjm","summary":"CGA-p8p2-gj68-wqjm","evidence":"osv:CGA-p8p2-gj68-wqjm","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p8p2-gj68-wqjm","aliases":["CGA-p8p2-gj68-wqjm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p8p2-gj68-wqjm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:10Z"}]}}],"modified":"2026-10-02T23:00:53.988755356Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b8c50ce3-4d67-4e4e-b7c6-c7d0cb1e5625","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p8p2-gj68-wqjm","advisory_id":"b8c50ce3-4d67-4e4e-b7c6-c7d0cb1e5625","event_types":["advisory"],"published_at":"2026-10-25T23:14:00.771079+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:29+00:00","detail_url":"/events/71896"},"members":[{"id":71896,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-p8p2-gj68-wqjm","summary":"CGA-p8p2-gj68-wqjm","evidence":"osv:CGA-p8p2-gj68-wqjm","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p8p2-gj68-wqjm","aliases":["CGA-p8p2-gj68-wqjm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p8p2-gj68-wqjm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:10Z"}]}}],"modified":"2026-10-02T23:00:53.988755356Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b8c50ce3-4d67-4e4e-b7c6-c7d0cb1e5625","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p8p2-gj68-wqjm","advisory_id":"b8c50ce3-4d67-4e4e-b7c6-c7d0cb1e5625","event_types":["advisory"],"published_at":"2026-10-25T23:14:00.771079+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:29+00:00","detail_url":"/events/71896"}]}},{"id":71445,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-mx22-j4h3-f975","summary":"CGA-mx22-j4h3-f975","evidence":"osv:CGA-mx22-j4h3-f975","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mx22-j4h3-f975","aliases":["CGA-mx22-j4h3-f975"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mx22-j4h3-f975.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:13Z"}]}}],"modified":"2026-10-02T23:00:53.176862994Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d0f5693a-0eef-446f-b048-0e82e62f2e69","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mx22-j4h3-f975","advisory_id":"d0f5693a-0eef-446f-b048-0e82e62f2e69","event_types":["advisory"],"published_at":"2026-10-25T23:10:34.485396+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:34+00:00","detail_url":"/advisories/advisory%3Ad0f5693a-0eef-446f-b048-0e82e62f2e69","group":{"id":"advisory:d0f5693a-0eef-446f-b048-0e82e62f2e69","revision":1,"primary_event_id":71844,"change":"published","superseded_by":[],"changed":{"id":71844,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-mx22-j4h3-f975","summary":"CGA-mx22-j4h3-f975","evidence":"osv:CGA-mx22-j4h3-f975","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mx22-j4h3-f975","aliases":["CGA-mx22-j4h3-f975"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mx22-j4h3-f975.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:13Z"}]}}],"modified":"2026-10-02T23:00:53.176862994Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d0f5693a-0eef-446f-b048-0e82e62f2e69","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mx22-j4h3-f975","advisory_id":"d0f5693a-0eef-446f-b048-0e82e62f2e69","event_types":["advisory"],"published_at":"2026-10-25T23:10:34.485396+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:34+00:00","detail_url":"/events/71844"},"members":[{"id":71844,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-mx22-j4h3-f975","summary":"CGA-mx22-j4h3-f975","evidence":"osv:CGA-mx22-j4h3-f975","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mx22-j4h3-f975","aliases":["CGA-mx22-j4h3-f975"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mx22-j4h3-f975.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:13Z"}]}}],"modified":"2026-10-02T23:00:53.176862994Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d0f5693a-0eef-446f-b048-0e82e62f2e69","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mx22-j4h3-f975","advisory_id":"d0f5693a-0eef-446f-b048-0e82e62f2e69","event_types":["advisory"],"published_at":"2026-10-25T23:10:34.485396+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:34+00:00","detail_url":"/events/71844"}]}},{"id":71369,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-f2x7-rh5r-f34r","summary":"CGA-f2x7-rh5r-f34r","evidence":"osv:CGA-f2x7-rh5r-f34r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-f2x7-rh5r-f34r","aliases":["CGA-f2x7-rh5r-f34r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f2x7-rh5r-f34r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:08Z"}]}}],"modified":"2026-10-02T23:00:45.904148925Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:284ebec2-3577-4cce-ba8a-42947567b373","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f2x7-rh5r-f34r","advisory_id":"284ebec2-3577-4cce-ba8a-42947567b373","event_types":["advisory"],"published_at":"2026-10-25T23:06:26.131391+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:28+00:00","detail_url":"/advisories/advisory%3A284ebec2-3577-4cce-ba8a-42947567b373","group":{"id":"advisory:284ebec2-3577-4cce-ba8a-42947567b373","revision":1,"primary_event_id":71760,"change":"published","superseded_by":[],"changed":{"id":71760,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-f2x7-rh5r-f34r","summary":"CGA-f2x7-rh5r-f34r","evidence":"osv:CGA-f2x7-rh5r-f34r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-f2x7-rh5r-f34r","aliases":["CGA-f2x7-rh5r-f34r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f2x7-rh5r-f34r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:08Z"}]}}],"modified":"2026-10-02T23:00:45.904148925Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:284ebec2-3577-4cce-ba8a-42947567b373","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f2x7-rh5r-f34r","advisory_id":"284ebec2-3577-4cce-ba8a-42947567b373","event_types":["advisory"],"published_at":"2026-10-25T23:06:26.131391+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:28+00:00","detail_url":"/events/71760"},"members":[{"id":71760,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-f2x7-rh5r-f34r","summary":"CGA-f2x7-rh5r-f34r","evidence":"osv:CGA-f2x7-rh5r-f34r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-f2x7-rh5r-f34r","aliases":["CGA-f2x7-rh5r-f34r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f2x7-rh5r-f34r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:08Z"}]}}],"modified":"2026-10-02T23:00:45.904148925Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:284ebec2-3577-4cce-ba8a-42947567b373","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f2x7-rh5r-f34r","advisory_id":"284ebec2-3577-4cce-ba8a-42947567b373","event_types":["advisory"],"published_at":"2026-10-25T23:06:26.131391+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:28+00:00","detail_url":"/events/71760"}]}},{"id":71289,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-6x2x-fcg5-h46f","summary":"CGA-6x2x-fcg5-h46f","evidence":"osv:CGA-6x2x-fcg5-h46f","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-6x2x-fcg5-h46f","aliases":["CGA-6x2x-fcg5-h46f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6x2x-fcg5-h46f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:12Z"}]}}],"modified":"2026-10-02T23:00:37.310732873Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2278b50e-ffde-4c18-9895-bc9bbdc9f43c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6x2x-fcg5-h46f","advisory_id":"2278b50e-ffde-4c18-9895-bc9bbdc9f43c","event_types":["advisory"],"published_at":"2026-10-25T23:00:52.401426+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:55+00:00","detail_url":"/advisories/advisory%3A2278b50e-ffde-4c18-9895-bc9bbdc9f43c","group":{"id":"advisory:2278b50e-ffde-4c18-9895-bc9bbdc9f43c","revision":1,"primary_event_id":71675,"change":"published","superseded_by":[],"changed":{"id":71675,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-6x2x-fcg5-h46f","summary":"CGA-6x2x-fcg5-h46f","evidence":"osv:CGA-6x2x-fcg5-h46f","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-6x2x-fcg5-h46f","aliases":["CGA-6x2x-fcg5-h46f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6x2x-fcg5-h46f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:12Z"}]}}],"modified":"2026-10-02T23:00:37.310732873Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2278b50e-ffde-4c18-9895-bc9bbdc9f43c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6x2x-fcg5-h46f","advisory_id":"2278b50e-ffde-4c18-9895-bc9bbdc9f43c","event_types":["advisory"],"published_at":"2026-10-25T23:00:52.401426+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:55+00:00","detail_url":"/events/71675"},"members":[{"id":71675,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-6x2x-fcg5-h46f","summary":"CGA-6x2x-fcg5-h46f","evidence":"osv:CGA-6x2x-fcg5-h46f","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-6x2x-fcg5-h46f","aliases":["CGA-6x2x-fcg5-h46f"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6x2x-fcg5-h46f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/legacy-geo/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:12Z"}]}}],"modified":"2026-10-02T23:00:37.310732873Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2278b50e-ffde-4c18-9895-bc9bbdc9f43c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6x2x-fcg5-h46f","advisory_id":"2278b50e-ffde-4c18-9895-bc9bbdc9f43c","event_types":["advisory"],"published_at":"2026-10-25T23:00:52.401426+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:55+00:00","detail_url":"/events/71675"}]}},{"id":71186,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-7693-769g-7jm4","summary":"CGA-7693-769g-7jm4","evidence":"osv:CGA-7693-769g-7jm4","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7693-769g-7jm4","aliases":["CGA-7693-769g-7jm4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7693-769g-7jm4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:09Z"}]}}],"modified":"2026-10-02T23:00:25.509223877Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ba271e18-d21c-470d-be5a-962363b2924b","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7693-769g-7jm4","advisory_id":"ba271e18-d21c-470d-be5a-962363b2924b","event_types":["advisory"],"published_at":"2026-10-25T22:55:05.569859+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:55+00:00","detail_url":"/advisories/advisory%3Aba271e18-d21c-470d-be5a-962363b2924b","group":{"id":"advisory:ba271e18-d21c-470d-be5a-962363b2924b","revision":1,"primary_event_id":71567,"change":"published","superseded_by":[],"changed":{"id":71567,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-7693-769g-7jm4","summary":"CGA-7693-769g-7jm4","evidence":"osv:CGA-7693-769g-7jm4","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7693-769g-7jm4","aliases":["CGA-7693-769g-7jm4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7693-769g-7jm4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:09Z"}]}}],"modified":"2026-10-02T23:00:25.509223877Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ba271e18-d21c-470d-be5a-962363b2924b","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7693-769g-7jm4","advisory_id":"ba271e18-d21c-470d-be5a-962363b2924b","event_types":["advisory"],"published_at":"2026-10-25T22:55:05.569859+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:55+00:00","detail_url":"/events/71567"},"members":[{"id":71567,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-7693-769g-7jm4","summary":"CGA-7693-769g-7jm4","evidence":"osv:CGA-7693-769g-7jm4","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7693-769g-7jm4","aliases":["CGA-7693-769g-7jm4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7693-769g-7jm4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:09Z"}]}}],"modified":"2026-10-02T23:00:25.509223877Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ba271e18-d21c-470d-be5a-962363b2924b","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7693-769g-7jm4","advisory_id":"ba271e18-d21c-470d-be5a-962363b2924b","event_types":["advisory"],"published_at":"2026-10-25T22:55:05.569859+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:55+00:00","detail_url":"/events/71567"}]}},{"id":71155,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2qf9-6q5p-v38v","summary":"CGA-2qf9-6q5p-v38v","evidence":"osv:CGA-2qf9-6q5p-v38v","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2qf9-6q5p-v38v","aliases":["CGA-2qf9-6q5p-v38v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2qf9-6q5p-v38v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:10Z"}]}}],"modified":"2026-10-02T23:00:21.956449305Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:41e6dfbb-a190-49c5-83ee-a2702c9a0314","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2qf9-6q5p-v38v","advisory_id":"41e6dfbb-a190-49c5-83ee-a2702c9a0314","event_types":["advisory"],"published_at":"2026-10-25T22:53:29.711678+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/advisories/advisory%3A41e6dfbb-a190-49c5-83ee-a2702c9a0314","group":{"id":"advisory:41e6dfbb-a190-49c5-83ee-a2702c9a0314","revision":1,"primary_event_id":71532,"change":"published","superseded_by":[],"changed":{"id":71532,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2qf9-6q5p-v38v","summary":"CGA-2qf9-6q5p-v38v","evidence":"osv:CGA-2qf9-6q5p-v38v","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2qf9-6q5p-v38v","aliases":["CGA-2qf9-6q5p-v38v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2qf9-6q5p-v38v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:10Z"}]}}],"modified":"2026-10-02T23:00:21.956449305Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:41e6dfbb-a190-49c5-83ee-a2702c9a0314","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2qf9-6q5p-v38v","advisory_id":"41e6dfbb-a190-49c5-83ee-a2702c9a0314","event_types":["advisory"],"published_at":"2026-10-25T22:53:29.711678+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/events/71532"},"members":[{"id":71532,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2qf9-6q5p-v38v","summary":"CGA-2qf9-6q5p-v38v","evidence":"osv:CGA-2qf9-6q5p-v38v","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2qf9-6q5p-v38v","aliases":["CGA-2qf9-6q5p-v38v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2qf9-6q5p-v38v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:10Z"}]}}],"modified":"2026-10-02T23:00:21.956449305Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:41e6dfbb-a190-49c5-83ee-a2702c9a0314","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2qf9-6q5p-v38v","advisory_id":"41e6dfbb-a190-49c5-83ee-a2702c9a0314","event_types":["advisory"],"published_at":"2026-10-25T22:53:29.711678+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:57+00:00","detail_url":"/events/71532"}]}},{"id":71129,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-x6v4-fg66-464p","summary":"CGA-x6v4-fg66-464p","evidence":"osv:CGA-x6v4-fg66-464p","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x6v4-fg66-464p","aliases":["CGA-x6v4-fg66-464p"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x6v4-fg66-464p.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:09Z"}]}}],"modified":"2026-10-02T23:00:19.452320467Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1ec2be9d-8ad8-4f1b-8bab-535a4835a839","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x6v4-fg66-464p","advisory_id":"1ec2be9d-8ad8-4f1b-8bab-535a4835a839","event_types":["advisory"],"published_at":"2026-10-25T22:52:18.043783+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:32+00:00","detail_url":"/advisories/advisory%3A1ec2be9d-8ad8-4f1b-8bab-535a4835a839","group":{"id":"advisory:1ec2be9d-8ad8-4f1b-8bab-535a4835a839","revision":1,"primary_event_id":71504,"change":"published","superseded_by":[],"changed":{"id":71504,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-x6v4-fg66-464p","summary":"CGA-x6v4-fg66-464p","evidence":"osv:CGA-x6v4-fg66-464p","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x6v4-fg66-464p","aliases":["CGA-x6v4-fg66-464p"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x6v4-fg66-464p.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:09Z"}]}}],"modified":"2026-10-02T23:00:19.452320467Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1ec2be9d-8ad8-4f1b-8bab-535a4835a839","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x6v4-fg66-464p","advisory_id":"1ec2be9d-8ad8-4f1b-8bab-535a4835a839","event_types":["advisory"],"published_at":"2026-10-25T22:52:18.043783+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:32+00:00","detail_url":"/events/71504"},"members":[{"id":71504,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-x6v4-fg66-464p","summary":"CGA-x6v4-fg66-464p","evidence":"osv:CGA-x6v4-fg66-464p","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x6v4-fg66-464p","aliases":["CGA-x6v4-fg66-464p"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x6v4-fg66-464p.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:09Z"}]}}],"modified":"2026-10-02T23:00:19.452320467Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1ec2be9d-8ad8-4f1b-8bab-535a4835a839","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x6v4-fg66-464p","advisory_id":"1ec2be9d-8ad8-4f1b-8bab-535a4835a839","event_types":["advisory"],"published_at":"2026-10-25T22:52:18.043783+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:32+00:00","detail_url":"/events/71504"}]}},{"id":71089,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3p5m-p9h8-f5fv","summary":"CGA-3p5m-p9h8-f5fv","evidence":"osv:CGA-3p5m-p9h8-f5fv","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3p5m-p9h8-f5fv","aliases":["CGA-3p5m-p9h8-f5fv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3p5m-p9h8-f5fv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:09Z"}]}}],"modified":"2026-10-02T23:00:14.353751159Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8c73098e-1b6d-4cb6-b3b7-185ea7f19214","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3p5m-p9h8-f5fv","advisory_id":"8c73098e-1b6d-4cb6-b3b7-185ea7f19214","event_types":["advisory"],"published_at":"2026-10-25T22:50:09.752891+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:35+00:00","detail_url":"/advisories/advisory%3A8c73098e-1b6d-4cb6-b3b7-185ea7f19214","group":{"id":"advisory:8c73098e-1b6d-4cb6-b3b7-185ea7f19214","revision":1,"primary_event_id":71463,"change":"published","superseded_by":[],"changed":{"id":71463,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3p5m-p9h8-f5fv","summary":"CGA-3p5m-p9h8-f5fv","evidence":"osv:CGA-3p5m-p9h8-f5fv","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3p5m-p9h8-f5fv","aliases":["CGA-3p5m-p9h8-f5fv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3p5m-p9h8-f5fv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:09Z"}]}}],"modified":"2026-10-02T23:00:14.353751159Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8c73098e-1b6d-4cb6-b3b7-185ea7f19214","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3p5m-p9h8-f5fv","advisory_id":"8c73098e-1b6d-4cb6-b3b7-185ea7f19214","event_types":["advisory"],"published_at":"2026-10-25T22:50:09.752891+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:35+00:00","detail_url":"/events/71463"},"members":[{"id":71463,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3p5m-p9h8-f5fv","summary":"CGA-3p5m-p9h8-f5fv","evidence":"osv:CGA-3p5m-p9h8-f5fv","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3p5m-p9h8-f5fv","aliases":["CGA-3p5m-p9h8-f5fv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3p5m-p9h8-f5fv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:09Z"}]}}],"modified":"2026-10-02T23:00:14.353751159Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8c73098e-1b6d-4cb6-b3b7-185ea7f19214","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3p5m-p9h8-f5fv","advisory_id":"8c73098e-1b6d-4cb6-b3b7-185ea7f19214","event_types":["advisory"],"published_at":"2026-10-25T22:50:09.752891+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:35+00:00","detail_url":"/events/71463"}]}},{"id":71077,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3hp3-mg5v-x42c","summary":"CGA-3hp3-mg5v-x42c","evidence":"osv:CGA-3hp3-mg5v-x42c","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3hp3-mg5v-x42c","aliases":["CGA-3hp3-mg5v-x42c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hp3-mg5v-x42c.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:11Z"}]}}],"modified":"2026-10-02T23:00:13.537613803Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hp3-mg5v-x42c","advisory_id":"99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","event_types":["advisory"],"published_at":"2026-10-25T22:49:34.609794+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:31+00:00","detail_url":"/advisories/advisory%3A99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","group":{"id":"advisory:99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","revision":1,"primary_event_id":71451,"change":"published","superseded_by":[],"changed":{"id":71451,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3hp3-mg5v-x42c","summary":"CGA-3hp3-mg5v-x42c","evidence":"osv:CGA-3hp3-mg5v-x42c","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3hp3-mg5v-x42c","aliases":["CGA-3hp3-mg5v-x42c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hp3-mg5v-x42c.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:11Z"}]}}],"modified":"2026-10-02T23:00:13.537613803Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hp3-mg5v-x42c","advisory_id":"99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","event_types":["advisory"],"published_at":"2026-10-25T22:49:34.609794+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:31+00:00","detail_url":"/events/71451"},"members":[{"id":71451,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3hp3-mg5v-x42c","summary":"CGA-3hp3-mg5v-x42c","evidence":"osv:CGA-3hp3-mg5v-x42c","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3hp3-mg5v-x42c","aliases":["CGA-3hp3-mg5v-x42c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hp3-mg5v-x42c.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:11Z"}]}}],"modified":"2026-10-02T23:00:13.537613803Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hp3-mg5v-x42c","advisory_id":"99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","event_types":["advisory"],"published_at":"2026-10-25T22:49:34.609794+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:31+00:00","detail_url":"/events/71451"}]}},{"id":71039,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-88hh-pxvw-23f9","summary":"CGA-88hh-pxvw-23f9","evidence":"osv:CGA-88hh-pxvw-23f9","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-88hh-pxvw-23f9","aliases":["CGA-88hh-pxvw-23f9"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-88hh-pxvw-23f9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:08Z"}]}}],"modified":"2026-10-02T23:00:09.435262545Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:72c8cfa9-a556-4eb0-8e6e-aa285ed6a168","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-88hh-pxvw-23f9","advisory_id":"72c8cfa9-a556-4eb0-8e6e-aa285ed6a168","event_types":["advisory"],"published_at":"2026-10-25T22:48:08.939893+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:56+00:00","detail_url":"/advisories/advisory%3A72c8cfa9-a556-4eb0-8e6e-aa285ed6a168","group":{"id":"advisory:72c8cfa9-a556-4eb0-8e6e-aa285ed6a168","revision":1,"primary_event_id":71413,"change":"published","superseded_by":[],"changed":{"id":71413,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-88hh-pxvw-23f9","summary":"CGA-88hh-pxvw-23f9","evidence":"osv:CGA-88hh-pxvw-23f9","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-88hh-pxvw-23f9","aliases":["CGA-88hh-pxvw-23f9"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-88hh-pxvw-23f9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:08Z"}]}}],"modified":"2026-10-02T23:00:09.435262545Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:72c8cfa9-a556-4eb0-8e6e-aa285ed6a168","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-88hh-pxvw-23f9","advisory_id":"72c8cfa9-a556-4eb0-8e6e-aa285ed6a168","event_types":["advisory"],"published_at":"2026-10-25T22:48:08.939893+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:56+00:00","detail_url":"/events/71413"},"members":[{"id":71413,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-88hh-pxvw-23f9","summary":"CGA-88hh-pxvw-23f9","evidence":"osv:CGA-88hh-pxvw-23f9","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-88hh-pxvw-23f9","aliases":["CGA-88hh-pxvw-23f9"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-88hh-pxvw-23f9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:08Z"}]}}],"modified":"2026-10-02T23:00:09.435262545Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:72c8cfa9-a556-4eb0-8e6e-aa285ed6a168","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-88hh-pxvw-23f9","advisory_id":"72c8cfa9-a556-4eb0-8e6e-aa285ed6a168","event_types":["advisory"],"published_at":"2026-10-25T22:48:08.939893+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:56+00:00","detail_url":"/events/71413"}]}},{"id":71037,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-537x-83cp-xq5r","summary":"CGA-537x-83cp-xq5r","evidence":"osv:CGA-537x-83cp-xq5r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-537x-83cp-xq5r","aliases":["CGA-537x-83cp-xq5r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-537x-83cp-xq5r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:13Z"}]}}],"modified":"2026-10-02T23:00:08.503793737Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6c82456b-bc07-4461-b468-e363fd9388f5","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-537x-83cp-xq5r","advisory_id":"6c82456b-bc07-4461-b468-e363fd9388f5","event_types":["advisory"],"published_at":"2026-10-25T22:48:05.283293+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:35+00:00","detail_url":"/advisories/advisory%3A6c82456b-bc07-4461-b468-e363fd9388f5","group":{"id":"advisory:6c82456b-bc07-4461-b468-e363fd9388f5","revision":1,"primary_event_id":71411,"change":"published","superseded_by":[],"changed":{"id":71411,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-537x-83cp-xq5r","summary":"CGA-537x-83cp-xq5r","evidence":"osv:CGA-537x-83cp-xq5r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-537x-83cp-xq5r","aliases":["CGA-537x-83cp-xq5r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-537x-83cp-xq5r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:13Z"}]}}],"modified":"2026-10-02T23:00:08.503793737Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6c82456b-bc07-4461-b468-e363fd9388f5","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-537x-83cp-xq5r","advisory_id":"6c82456b-bc07-4461-b468-e363fd9388f5","event_types":["advisory"],"published_at":"2026-10-25T22:48:05.283293+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:35+00:00","detail_url":"/events/71411"},"members":[{"id":71411,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-537x-83cp-xq5r","summary":"CGA-537x-83cp-xq5r","evidence":"osv:CGA-537x-83cp-xq5r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-537x-83cp-xq5r","aliases":["CGA-537x-83cp-xq5r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-537x-83cp-xq5r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:13Z"}]}}],"modified":"2026-10-02T23:00:08.503793737Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6c82456b-bc07-4461-b468-e363fd9388f5","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-537x-83cp-xq5r","advisory_id":"6c82456b-bc07-4461-b468-e363fd9388f5","event_types":["advisory"],"published_at":"2026-10-25T22:48:05.283293+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:35+00:00","detail_url":"/events/71411"}]}},{"id":71036,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-5c33-98h2-297r","summary":"CGA-5c33-98h2-297r","evidence":"osv:CGA-5c33-98h2-297r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5c33-98h2-297r","aliases":["CGA-5c33-98h2-297r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5c33-98h2-297r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:11Z"}]}}],"modified":"2026-10-02T23:00:08.989582984Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7b23479d-0a3c-453d-a0d7-d65023d55009","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5c33-98h2-297r","advisory_id":"7b23479d-0a3c-453d-a0d7-d65023d55009","event_types":["advisory"],"published_at":"2026-10-25T22:48:02.553867+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:53+00:00","detail_url":"/advisories/advisory%3A7b23479d-0a3c-453d-a0d7-d65023d55009","group":{"id":"advisory:7b23479d-0a3c-453d-a0d7-d65023d55009","revision":1,"primary_event_id":71410,"change":"published","superseded_by":[],"changed":{"id":71410,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-5c33-98h2-297r","summary":"CGA-5c33-98h2-297r","evidence":"osv:CGA-5c33-98h2-297r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5c33-98h2-297r","aliases":["CGA-5c33-98h2-297r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5c33-98h2-297r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:11Z"}]}}],"modified":"2026-10-02T23:00:08.989582984Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7b23479d-0a3c-453d-a0d7-d65023d55009","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5c33-98h2-297r","advisory_id":"7b23479d-0a3c-453d-a0d7-d65023d55009","event_types":["advisory"],"published_at":"2026-10-25T22:48:02.553867+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:53+00:00","detail_url":"/events/71410"},"members":[{"id":71410,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-5c33-98h2-297r","summary":"CGA-5c33-98h2-297r","evidence":"osv:CGA-5c33-98h2-297r","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5c33-98h2-297r","aliases":["CGA-5c33-98h2-297r"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5c33-98h2-297r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/bin/elasticsearch-sql-cli-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:11Z"}]}}],"modified":"2026-10-02T23:00:08.989582984Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7b23479d-0a3c-453d-a0d7-d65023d55009","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5c33-98h2-297r","advisory_id":"7b23479d-0a3c-453d-a0d7-d65023d55009","event_types":["advisory"],"published_at":"2026-10-25T22:48:02.553867+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:53+00:00","detail_url":"/events/71410"}]}},{"id":71032,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-5hp9-qg43-p5vg","summary":"CGA-5hp9-qg43-p5vg","evidence":"osv:CGA-5hp9-qg43-p5vg","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5hp9-qg43-p5vg","aliases":["CGA-5hp9-qg43-p5vg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5hp9-qg43-p5vg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:08Z"}]}}],"modified":"2026-10-02T23:00:08.483518556Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b16422ba-8442-4367-8a47-52bf9930dc1d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5hp9-qg43-p5vg","advisory_id":"b16422ba-8442-4367-8a47-52bf9930dc1d","event_types":["advisory"],"published_at":"2026-10-25T22:47:53.428636+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:54+00:00","detail_url":"/advisories/advisory%3Ab16422ba-8442-4367-8a47-52bf9930dc1d","group":{"id":"advisory:b16422ba-8442-4367-8a47-52bf9930dc1d","revision":1,"primary_event_id":71406,"change":"published","superseded_by":[],"changed":{"id":71406,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-5hp9-qg43-p5vg","summary":"CGA-5hp9-qg43-p5vg","evidence":"osv:CGA-5hp9-qg43-p5vg","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5hp9-qg43-p5vg","aliases":["CGA-5hp9-qg43-p5vg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5hp9-qg43-p5vg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:08Z"}]}}],"modified":"2026-10-02T23:00:08.483518556Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b16422ba-8442-4367-8a47-52bf9930dc1d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5hp9-qg43-p5vg","advisory_id":"b16422ba-8442-4367-8a47-52bf9930dc1d","event_types":["advisory"],"published_at":"2026-10-25T22:47:53.428636+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:54+00:00","detail_url":"/events/71406"},"members":[{"id":71406,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-5hp9-qg43-p5vg","summary":"CGA-5hp9-qg43-p5vg","evidence":"osv:CGA-5hp9-qg43-p5vg","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5hp9-qg43-p5vg","aliases":["CGA-5hp9-qg43-p5vg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5hp9-qg43-p5vg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:08Z"}]}}],"modified":"2026-10-02T23:00:08.483518556Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b16422ba-8442-4367-8a47-52bf9930dc1d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5hp9-qg43-p5vg","advisory_id":"b16422ba-8442-4367-8a47-52bf9930dc1d","event_types":["advisory"],"published_at":"2026-10-25T22:47:53.428636+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:54+00:00","detail_url":"/events/71406"}]}},{"id":71028,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-49h7-xmfv-4gf2","summary":"CGA-49h7-xmfv-4gf2","evidence":"osv:CGA-49h7-xmfv-4gf2","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-49h7-xmfv-4gf2","aliases":["CGA-49h7-xmfv-4gf2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-49h7-xmfv-4gf2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:10Z"}]}}],"modified":"2026-10-02T23:00:07.620214357Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:86543a3b-7dca-45f6-b1f1-2ec2445a2b5b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-49h7-xmfv-4gf2","advisory_id":"86543a3b-7dca-45f6-b1f1-2ec2445a2b5b","event_types":["advisory"],"published_at":"2026-10-25T22:47:39.870755+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:54+00:00","detail_url":"/advisories/advisory%3A86543a3b-7dca-45f6-b1f1-2ec2445a2b5b","group":{"id":"advisory:86543a3b-7dca-45f6-b1f1-2ec2445a2b5b","revision":1,"primary_event_id":71402,"change":"published","superseded_by":[],"changed":{"id":71402,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-49h7-xmfv-4gf2","summary":"CGA-49h7-xmfv-4gf2","evidence":"osv:CGA-49h7-xmfv-4gf2","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-49h7-xmfv-4gf2","aliases":["CGA-49h7-xmfv-4gf2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-49h7-xmfv-4gf2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:10Z"}]}}],"modified":"2026-10-02T23:00:07.620214357Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:86543a3b-7dca-45f6-b1f1-2ec2445a2b5b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-49h7-xmfv-4gf2","advisory_id":"86543a3b-7dca-45f6-b1f1-2ec2445a2b5b","event_types":["advisory"],"published_at":"2026-10-25T22:47:39.870755+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:54+00:00","detail_url":"/events/71402"},"members":[{"id":71402,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-49h7-xmfv-4gf2","summary":"CGA-49h7-xmfv-4gf2","evidence":"osv:CGA-49h7-xmfv-4gf2","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-49h7-xmfv-4gf2","aliases":["CGA-49h7-xmfv-4gf2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-49h7-xmfv-4gf2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:53:10Z"}]}}],"modified":"2026-10-02T23:00:07.620214357Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:86543a3b-7dca-45f6-b1f1-2ec2445a2b5b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-49h7-xmfv-4gf2","advisory_id":"86543a3b-7dca-45f6-b1f1-2ec2445a2b5b","event_types":["advisory"],"published_at":"2026-10-25T22:47:39.870755+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:54+00:00","detail_url":"/events/71402"}]}},{"id":71015,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-42wr-35fv-2rmh","summary":"CGA-42wr-35fv-2rmh","evidence":"osv:CGA-42wr-35fv-2rmh","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-42wr-35fv-2rmh","aliases":["CGA-42wr-35fv-2rmh"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-42wr-35fv-2rmh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:09Z"}]}}],"modified":"2026-10-02T23:00:06.507631763Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c031b4f3-8966-4915-9bcf-4f7834893e83","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-42wr-35fv-2rmh","advisory_id":"c031b4f3-8966-4915-9bcf-4f7834893e83","event_types":["advisory"],"published_at":"2026-10-25T22:47:00.133818+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:34+00:00","detail_url":"/advisories/advisory%3Ac031b4f3-8966-4915-9bcf-4f7834893e83","group":{"id":"advisory:c031b4f3-8966-4915-9bcf-4f7834893e83","revision":1,"primary_event_id":71389,"change":"published","superseded_by":[],"changed":{"id":71389,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-42wr-35fv-2rmh","summary":"CGA-42wr-35fv-2rmh","evidence":"osv:CGA-42wr-35fv-2rmh","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-42wr-35fv-2rmh","aliases":["CGA-42wr-35fv-2rmh"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-42wr-35fv-2rmh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:09Z"}]}}],"modified":"2026-10-02T23:00:06.507631763Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c031b4f3-8966-4915-9bcf-4f7834893e83","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-42wr-35fv-2rmh","advisory_id":"c031b4f3-8966-4915-9bcf-4f7834893e83","event_types":["advisory"],"published_at":"2026-10-25T22:47:00.133818+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:34+00:00","detail_url":"/events/71389"},"members":[{"id":71389,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-42wr-35fv-2rmh","summary":"CGA-42wr-35fv-2rmh","evidence":"osv:CGA-42wr-35fv-2rmh","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-42wr-35fv-2rmh","aliases":["CGA-42wr-35fv-2rmh"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-42wr-35fv-2rmh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/modules/x-pack-monitoring/jackson-core-2.18.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:09Z"}]}}],"modified":"2026-10-02T23:00:06.507631763Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c031b4f3-8966-4915-9bcf-4f7834893e83","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-42wr-35fv-2rmh","advisory_id":"c031b4f3-8966-4915-9bcf-4f7834893e83","event_types":["advisory"],"published_at":"2026-10-25T22:47:00.133818+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:34+00:00","detail_url":"/events/71389"}]}}],"next_after":72040,"next_before":71015}