{"schema_version":"2","view":"grouped","data":[{"id":74738,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-wqp8-3p52-6w4h","summary":"CGA-wqp8-3p52-6w4h","evidence":"osv:CGA-wqp8-3p52-6w4h","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wqp8-3p52-6w4h","aliases":["CGA-wqp8-3p52-6w4h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqp8-3p52-6w4h.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:10Z"}]}}],"modified":"2026-10-03T17:25:49.088242192Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e27000b8-f678-437c-a4d7-08a5dfe13ead","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wqp8-3p52-6w4h","advisory_id":"e27000b8-f678-437c-a4d7-08a5dfe13ead","event_types":["advisory"],"published_at":"2026-10-26T13:18:54.666514+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:52+00:00","detail_url":"/advisories/advisory%3Ae27000b8-f678-437c-a4d7-08a5dfe13ead","group":{"id":"advisory:e27000b8-f678-437c-a4d7-08a5dfe13ead","revision":1,"primary_event_id":80647,"change":"published","superseded_by":[],"changed":{"id":80647,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-wqp8-3p52-6w4h","summary":"CGA-wqp8-3p52-6w4h","evidence":"osv:CGA-wqp8-3p52-6w4h","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wqp8-3p52-6w4h","aliases":["CGA-wqp8-3p52-6w4h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqp8-3p52-6w4h.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:10Z"}]}}],"modified":"2026-10-03T17:25:49.088242192Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e27000b8-f678-437c-a4d7-08a5dfe13ead","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wqp8-3p52-6w4h","advisory_id":"e27000b8-f678-437c-a4d7-08a5dfe13ead","event_types":["advisory"],"published_at":"2026-10-26T13:18:54.666514+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:52+00:00","detail_url":"/events/80647"},"members":[{"id":80647,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-wqp8-3p52-6w4h","summary":"CGA-wqp8-3p52-6w4h","evidence":"osv:CGA-wqp8-3p52-6w4h","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wqp8-3p52-6w4h","aliases":["CGA-wqp8-3p52-6w4h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqp8-3p52-6w4h.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:10Z"}]}}],"modified":"2026-10-03T17:25:49.088242192Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e27000b8-f678-437c-a4d7-08a5dfe13ead","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wqp8-3p52-6w4h","advisory_id":"e27000b8-f678-437c-a4d7-08a5dfe13ead","event_types":["advisory"],"published_at":"2026-10-26T13:18:54.666514+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:52+00:00","detail_url":"/events/80647"}]}},{"id":74732,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-rg69-mmx7-8xwg","summary":"CGA-rg69-mmx7-8xwg","evidence":"osv:CGA-rg69-mmx7-8xwg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rg69-mmx7-8xwg","aliases":["CGA-rg69-mmx7-8xwg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rg69-mmx7-8xwg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:12Z"}]}}],"modified":"2026-10-03T17:25:43.776561987Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:09c6f9df-c13d-40fa-9e4b-d1dc4ebc512a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rg69-mmx7-8xwg","advisory_id":"09c6f9df-c13d-40fa-9e4b-d1dc4ebc512a","event_types":["advisory"],"published_at":"2026-10-26T13:12:44.123262+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:53+00:00","detail_url":"/advisories/advisory%3A09c6f9df-c13d-40fa-9e4b-d1dc4ebc512a","group":{"id":"advisory:09c6f9df-c13d-40fa-9e4b-d1dc4ebc512a","revision":1,"primary_event_id":80617,"change":"published","superseded_by":[],"changed":{"id":80617,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-rg69-mmx7-8xwg","summary":"CGA-rg69-mmx7-8xwg","evidence":"osv:CGA-rg69-mmx7-8xwg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rg69-mmx7-8xwg","aliases":["CGA-rg69-mmx7-8xwg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rg69-mmx7-8xwg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:12Z"}]}}],"modified":"2026-10-03T17:25:43.776561987Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:09c6f9df-c13d-40fa-9e4b-d1dc4ebc512a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rg69-mmx7-8xwg","advisory_id":"09c6f9df-c13d-40fa-9e4b-d1dc4ebc512a","event_types":["advisory"],"published_at":"2026-10-26T13:12:44.123262+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:53+00:00","detail_url":"/events/80617"},"members":[{"id":80617,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-rg69-mmx7-8xwg","summary":"CGA-rg69-mmx7-8xwg","evidence":"osv:CGA-rg69-mmx7-8xwg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rg69-mmx7-8xwg","aliases":["CGA-rg69-mmx7-8xwg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rg69-mmx7-8xwg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:12Z"}]}}],"modified":"2026-10-03T17:25:43.776561987Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:09c6f9df-c13d-40fa-9e4b-d1dc4ebc512a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rg69-mmx7-8xwg","advisory_id":"09c6f9df-c13d-40fa-9e4b-d1dc4ebc512a","event_types":["advisory"],"published_at":"2026-10-26T13:12:44.123262+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:53+00:00","detail_url":"/events/80617"}]}},{"id":74711,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-wrj5-53w7-v3hg","summary":"CGA-wrj5-53w7-v3hg","evidence":"osv:CGA-wrj5-53w7-v3hg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wrj5-53w7-v3hg","aliases":["CGA-wrj5-53w7-v3hg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrj5-53w7-v3hg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:41.994480827Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0493069e-65de-442f-b2be-2fd155aff175","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrj5-53w7-v3hg","advisory_id":"0493069e-65de-442f-b2be-2fd155aff175","event_types":["advisory"],"published_at":"2026-10-26T13:07:22.437049+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:45+00:00","detail_url":"/advisories/advisory%3A0493069e-65de-442f-b2be-2fd155aff175","group":{"id":"advisory:0493069e-65de-442f-b2be-2fd155aff175","revision":1,"primary_event_id":80572,"change":"published","superseded_by":[],"changed":{"id":80572,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-wrj5-53w7-v3hg","summary":"CGA-wrj5-53w7-v3hg","evidence":"osv:CGA-wrj5-53w7-v3hg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wrj5-53w7-v3hg","aliases":["CGA-wrj5-53w7-v3hg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrj5-53w7-v3hg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:41.994480827Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0493069e-65de-442f-b2be-2fd155aff175","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrj5-53w7-v3hg","advisory_id":"0493069e-65de-442f-b2be-2fd155aff175","event_types":["advisory"],"published_at":"2026-10-26T13:07:22.437049+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:45+00:00","detail_url":"/events/80572"},"members":[{"id":80572,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-wrj5-53w7-v3hg","summary":"CGA-wrj5-53w7-v3hg","evidence":"osv:CGA-wrj5-53w7-v3hg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wrj5-53w7-v3hg","aliases":["CGA-wrj5-53w7-v3hg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrj5-53w7-v3hg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:41.994480827Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0493069e-65de-442f-b2be-2fd155aff175","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrj5-53w7-v3hg","advisory_id":"0493069e-65de-442f-b2be-2fd155aff175","event_types":["advisory"],"published_at":"2026-10-26T13:07:22.437049+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:45+00:00","detail_url":"/events/80572"}]}},{"id":74702,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-qcgw-f2hc-4wvf","summary":"CGA-qcgw-f2hc-4wvf","evidence":"osv:CGA-qcgw-f2hc-4wvf","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qcgw-f2hc-4wvf","aliases":["CGA-qcgw-f2hc-4wvf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qcgw-f2hc-4wvf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:40.618840191Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:992510a4-c85d-48ba-a237-2556cae7f845","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qcgw-f2hc-4wvf","advisory_id":"992510a4-c85d-48ba-a237-2556cae7f845","event_types":["advisory"],"published_at":"2026-10-26T12:46:22.723749+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:43+00:00","detail_url":"/advisories/advisory%3A992510a4-c85d-48ba-a237-2556cae7f845","group":{"id":"advisory:992510a4-c85d-48ba-a237-2556cae7f845","revision":1,"primary_event_id":80522,"change":"published","superseded_by":[],"changed":{"id":80522,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-qcgw-f2hc-4wvf","summary":"CGA-qcgw-f2hc-4wvf","evidence":"osv:CGA-qcgw-f2hc-4wvf","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qcgw-f2hc-4wvf","aliases":["CGA-qcgw-f2hc-4wvf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qcgw-f2hc-4wvf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:40.618840191Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:992510a4-c85d-48ba-a237-2556cae7f845","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qcgw-f2hc-4wvf","advisory_id":"992510a4-c85d-48ba-a237-2556cae7f845","event_types":["advisory"],"published_at":"2026-10-26T12:46:22.723749+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:43+00:00","detail_url":"/events/80522"},"members":[{"id":80522,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-qcgw-f2hc-4wvf","summary":"CGA-qcgw-f2hc-4wvf","evidence":"osv:CGA-qcgw-f2hc-4wvf","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qcgw-f2hc-4wvf","aliases":["CGA-qcgw-f2hc-4wvf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qcgw-f2hc-4wvf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:40.618840191Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:992510a4-c85d-48ba-a237-2556cae7f845","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qcgw-f2hc-4wvf","advisory_id":"992510a4-c85d-48ba-a237-2556cae7f845","event_types":["advisory"],"published_at":"2026-10-26T12:46:22.723749+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:43+00:00","detail_url":"/events/80522"}]}},{"id":74701,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-qcv3-q7fg-3q56","summary":"CGA-qcv3-q7fg-3q56","evidence":"osv:CGA-qcv3-q7fg-3q56","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qcv3-q7fg-3q56","aliases":["CGA-qcv3-q7fg-3q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qcv3-q7fg-3q56.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:12Z"}]}}],"modified":"2026-10-03T17:25:40.819800346Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:61b367ae-9b07-4aea-9cd9-ee641f08c31c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qcv3-q7fg-3q56","advisory_id":"61b367ae-9b07-4aea-9cd9-ee641f08c31c","event_types":["advisory"],"published_at":"2026-10-26T12:45:18.890596+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:52+00:00","detail_url":"/advisories/advisory%3A61b367ae-9b07-4aea-9cd9-ee641f08c31c","group":{"id":"advisory:61b367ae-9b07-4aea-9cd9-ee641f08c31c","revision":1,"primary_event_id":80517,"change":"published","superseded_by":[],"changed":{"id":80517,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-qcv3-q7fg-3q56","summary":"CGA-qcv3-q7fg-3q56","evidence":"osv:CGA-qcv3-q7fg-3q56","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qcv3-q7fg-3q56","aliases":["CGA-qcv3-q7fg-3q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qcv3-q7fg-3q56.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:12Z"}]}}],"modified":"2026-10-03T17:25:40.819800346Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:61b367ae-9b07-4aea-9cd9-ee641f08c31c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qcv3-q7fg-3q56","advisory_id":"61b367ae-9b07-4aea-9cd9-ee641f08c31c","event_types":["advisory"],"published_at":"2026-10-26T12:45:18.890596+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:52+00:00","detail_url":"/events/80517"},"members":[{"id":80517,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-qcv3-q7fg-3q56","summary":"CGA-qcv3-q7fg-3q56","evidence":"osv:CGA-qcv3-q7fg-3q56","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qcv3-q7fg-3q56","aliases":["CGA-qcv3-q7fg-3q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qcv3-q7fg-3q56.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:12Z"}]}}],"modified":"2026-10-03T17:25:40.819800346Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:61b367ae-9b07-4aea-9cd9-ee641f08c31c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qcv3-q7fg-3q56","advisory_id":"61b367ae-9b07-4aea-9cd9-ee641f08c31c","event_types":["advisory"],"published_at":"2026-10-26T12:45:18.890596+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:52+00:00","detail_url":"/events/80517"}]}},{"id":74694,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-ppq5-p6vc-xqw4","summary":"CGA-ppq5-p6vc-xqw4","evidence":"osv:CGA-ppq5-p6vc-xqw4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-ppq5-p6vc-xqw4","aliases":["CGA-ppq5-p6vc-xqw4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ppq5-p6vc-xqw4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:13Z"}]}}],"modified":"2026-10-03T17:25:39.267806602Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0f40c3d6-6485-499f-84fa-5d96bc062463","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ppq5-p6vc-xqw4","advisory_id":"0f40c3d6-6485-499f-84fa-5d96bc062463","event_types":["advisory"],"published_at":"2026-10-26T12:32:21.635384+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:49+00:00","detail_url":"/advisories/advisory%3A0f40c3d6-6485-499f-84fa-5d96bc062463","group":{"id":"advisory:0f40c3d6-6485-499f-84fa-5d96bc062463","revision":1,"primary_event_id":80448,"change":"published","superseded_by":[],"changed":{"id":80448,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-ppq5-p6vc-xqw4","summary":"CGA-ppq5-p6vc-xqw4","evidence":"osv:CGA-ppq5-p6vc-xqw4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-ppq5-p6vc-xqw4","aliases":["CGA-ppq5-p6vc-xqw4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ppq5-p6vc-xqw4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:13Z"}]}}],"modified":"2026-10-03T17:25:39.267806602Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0f40c3d6-6485-499f-84fa-5d96bc062463","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ppq5-p6vc-xqw4","advisory_id":"0f40c3d6-6485-499f-84fa-5d96bc062463","event_types":["advisory"],"published_at":"2026-10-26T12:32:21.635384+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:49+00:00","detail_url":"/events/80448"},"members":[{"id":80448,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-ppq5-p6vc-xqw4","summary":"CGA-ppq5-p6vc-xqw4","evidence":"osv:CGA-ppq5-p6vc-xqw4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-ppq5-p6vc-xqw4","aliases":["CGA-ppq5-p6vc-xqw4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ppq5-p6vc-xqw4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:13Z"}]}}],"modified":"2026-10-03T17:25:39.267806602Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0f40c3d6-6485-499f-84fa-5d96bc062463","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ppq5-p6vc-xqw4","advisory_id":"0f40c3d6-6485-499f-84fa-5d96bc062463","event_types":["advisory"],"published_at":"2026-10-26T12:32:21.635384+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:49+00:00","detail_url":"/events/80448"}]}},{"id":74683,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-m876-7rx8-9jwr","summary":"CGA-m876-7rx8-9jwr","evidence":"osv:CGA-m876-7rx8-9jwr","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m876-7rx8-9jwr","aliases":["CGA-m876-7rx8-9jwr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m876-7rx8-9jwr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:35.978560435Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a4fd8cf9-9d13-4e3d-ae80-64be40a7e5cf","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m876-7rx8-9jwr","advisory_id":"a4fd8cf9-9d13-4e3d-ae80-64be40a7e5cf","event_types":["advisory"],"published_at":"2026-10-26T12:24:16.141134+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:44+00:00","detail_url":"/advisories/advisory%3Aa4fd8cf9-9d13-4e3d-ae80-64be40a7e5cf","group":{"id":"advisory:a4fd8cf9-9d13-4e3d-ae80-64be40a7e5cf","revision":1,"primary_event_id":80395,"change":"published","superseded_by":[],"changed":{"id":80395,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-m876-7rx8-9jwr","summary":"CGA-m876-7rx8-9jwr","evidence":"osv:CGA-m876-7rx8-9jwr","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m876-7rx8-9jwr","aliases":["CGA-m876-7rx8-9jwr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m876-7rx8-9jwr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:35.978560435Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a4fd8cf9-9d13-4e3d-ae80-64be40a7e5cf","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m876-7rx8-9jwr","advisory_id":"a4fd8cf9-9d13-4e3d-ae80-64be40a7e5cf","event_types":["advisory"],"published_at":"2026-10-26T12:24:16.141134+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:44+00:00","detail_url":"/events/80395"},"members":[{"id":80395,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-m876-7rx8-9jwr","summary":"CGA-m876-7rx8-9jwr","evidence":"osv:CGA-m876-7rx8-9jwr","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m876-7rx8-9jwr","aliases":["CGA-m876-7rx8-9jwr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m876-7rx8-9jwr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:35.978560435Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a4fd8cf9-9d13-4e3d-ae80-64be40a7e5cf","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m876-7rx8-9jwr","advisory_id":"a4fd8cf9-9d13-4e3d-ae80-64be40a7e5cf","event_types":["advisory"],"published_at":"2026-10-26T12:24:16.141134+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:44+00:00","detail_url":"/events/80395"}]}},{"id":74667,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-h9v6-m5ff-wwj6","summary":"CGA-h9v6-m5ff-wwj6","evidence":"osv:CGA-h9v6-m5ff-wwj6","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-h9v6-m5ff-wwj6","aliases":["CGA-h9v6-m5ff-wwj6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h9v6-m5ff-wwj6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:11Z"}]}}],"modified":"2026-10-03T17:25:33.165845270Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fd920ad9-f7b9-475b-bf1f-f749fcf86a6d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h9v6-m5ff-wwj6","advisory_id":"fd920ad9-f7b9-475b-bf1f-f749fcf86a6d","event_types":["advisory"],"published_at":"2026-10-26T12:14:19.300906+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:51+00:00","detail_url":"/advisories/advisory%3Afd920ad9-f7b9-475b-bf1f-f749fcf86a6d","group":{"id":"advisory:fd920ad9-f7b9-475b-bf1f-f749fcf86a6d","revision":1,"primary_event_id":80323,"change":"published","superseded_by":[],"changed":{"id":80323,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-h9v6-m5ff-wwj6","summary":"CGA-h9v6-m5ff-wwj6","evidence":"osv:CGA-h9v6-m5ff-wwj6","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-h9v6-m5ff-wwj6","aliases":["CGA-h9v6-m5ff-wwj6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h9v6-m5ff-wwj6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:11Z"}]}}],"modified":"2026-10-03T17:25:33.165845270Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fd920ad9-f7b9-475b-bf1f-f749fcf86a6d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h9v6-m5ff-wwj6","advisory_id":"fd920ad9-f7b9-475b-bf1f-f749fcf86a6d","event_types":["advisory"],"published_at":"2026-10-26T12:14:19.300906+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:51+00:00","detail_url":"/events/80323"},"members":[{"id":80323,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-h9v6-m5ff-wwj6","summary":"CGA-h9v6-m5ff-wwj6","evidence":"osv:CGA-h9v6-m5ff-wwj6","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-h9v6-m5ff-wwj6","aliases":["CGA-h9v6-m5ff-wwj6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h9v6-m5ff-wwj6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:11Z"}]}}],"modified":"2026-10-03T17:25:33.165845270Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fd920ad9-f7b9-475b-bf1f-f749fcf86a6d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h9v6-m5ff-wwj6","advisory_id":"fd920ad9-f7b9-475b-bf1f-f749fcf86a6d","event_types":["advisory"],"published_at":"2026-10-26T12:14:19.300906+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:51+00:00","detail_url":"/events/80323"}]}},{"id":74657,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gp7j-j2hh-754m","summary":"CGA-gp7j-j2hh-754m","evidence":"osv:CGA-gp7j-j2hh-754m","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gp7j-j2hh-754m","aliases":["CGA-gp7j-j2hh-754m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gp7j-j2hh-754m.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:09Z"}]}}],"modified":"2026-10-03T17:25:30.165370040Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:03484e0d-e548-47f1-a40f-239043e4b602","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gp7j-j2hh-754m","advisory_id":"03484e0d-e548-47f1-a40f-239043e4b602","event_types":["advisory"],"published_at":"2026-10-26T12:08:45.385385+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:50+00:00","detail_url":"/advisories/advisory%3A03484e0d-e548-47f1-a40f-239043e4b602","group":{"id":"advisory:03484e0d-e548-47f1-a40f-239043e4b602","revision":1,"primary_event_id":80283,"change":"published","superseded_by":[],"changed":{"id":80283,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gp7j-j2hh-754m","summary":"CGA-gp7j-j2hh-754m","evidence":"osv:CGA-gp7j-j2hh-754m","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gp7j-j2hh-754m","aliases":["CGA-gp7j-j2hh-754m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gp7j-j2hh-754m.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:09Z"}]}}],"modified":"2026-10-03T17:25:30.165370040Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:03484e0d-e548-47f1-a40f-239043e4b602","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gp7j-j2hh-754m","advisory_id":"03484e0d-e548-47f1-a40f-239043e4b602","event_types":["advisory"],"published_at":"2026-10-26T12:08:45.385385+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:50+00:00","detail_url":"/events/80283"},"members":[{"id":80283,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-gp7j-j2hh-754m","summary":"CGA-gp7j-j2hh-754m","evidence":"osv:CGA-gp7j-j2hh-754m","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gp7j-j2hh-754m","aliases":["CGA-gp7j-j2hh-754m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gp7j-j2hh-754m.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:09Z"}]}}],"modified":"2026-10-03T17:25:30.165370040Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:03484e0d-e548-47f1-a40f-239043e4b602","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gp7j-j2hh-754m","advisory_id":"03484e0d-e548-47f1-a40f-239043e4b602","event_types":["advisory"],"published_at":"2026-10-26T12:08:45.385385+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:50+00:00","detail_url":"/events/80283"}]}},{"id":74645,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-f9q4-p5vg-h85w","summary":"CGA-f9q4-p5vg-h85w","evidence":"osv:CGA-f9q4-p5vg-h85w","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f9q4-p5vg-h85w","aliases":["CGA-f9q4-p5vg-h85w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f9q4-p5vg-h85w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:27.849657586Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d9635e62-364c-4ff4-af16-2ad75254b73b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f9q4-p5vg-h85w","advisory_id":"d9635e62-364c-4ff4-af16-2ad75254b73b","event_types":["advisory"],"published_at":"2026-10-26T12:04:19.870566+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:43+00:00","detail_url":"/advisories/advisory%3Ad9635e62-364c-4ff4-af16-2ad75254b73b","group":{"id":"advisory:d9635e62-364c-4ff4-af16-2ad75254b73b","revision":1,"primary_event_id":80238,"change":"published","superseded_by":[],"changed":{"id":80238,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-f9q4-p5vg-h85w","summary":"CGA-f9q4-p5vg-h85w","evidence":"osv:CGA-f9q4-p5vg-h85w","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f9q4-p5vg-h85w","aliases":["CGA-f9q4-p5vg-h85w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f9q4-p5vg-h85w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:27.849657586Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d9635e62-364c-4ff4-af16-2ad75254b73b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f9q4-p5vg-h85w","advisory_id":"d9635e62-364c-4ff4-af16-2ad75254b73b","event_types":["advisory"],"published_at":"2026-10-26T12:04:19.870566+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:43+00:00","detail_url":"/events/80238"},"members":[{"id":80238,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-f9q4-p5vg-h85w","summary":"CGA-f9q4-p5vg-h85w","evidence":"osv:CGA-f9q4-p5vg-h85w","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f9q4-p5vg-h85w","aliases":["CGA-f9q4-p5vg-h85w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f9q4-p5vg-h85w.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:27.849657586Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d9635e62-364c-4ff4-af16-2ad75254b73b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f9q4-p5vg-h85w","advisory_id":"d9635e62-364c-4ff4-af16-2ad75254b73b","event_types":["advisory"],"published_at":"2026-10-26T12:04:19.870566+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:43+00:00","detail_url":"/events/80238"}]}},{"id":74642,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-f2wx-vrcx-jmvv","summary":"CGA-f2wx-vrcx-jmvv","evidence":"osv:CGA-f2wx-vrcx-jmvv","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f2wx-vrcx-jmvv","aliases":["CGA-f2wx-vrcx-jmvv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f2wx-vrcx-jmvv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:14Z"}]}}],"modified":"2026-10-03T17:25:23.033620019Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c7d63468-1c1d-4c68-910e-5fdd1aaf4ee1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f2wx-vrcx-jmvv","advisory_id":"c7d63468-1c1d-4c68-910e-5fdd1aaf4ee1","event_types":["advisory"],"published_at":"2026-10-26T12:03:29.297549+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:51+00:00","detail_url":"/advisories/advisory%3Ac7d63468-1c1d-4c68-910e-5fdd1aaf4ee1","group":{"id":"advisory:c7d63468-1c1d-4c68-910e-5fdd1aaf4ee1","revision":1,"primary_event_id":80229,"change":"published","superseded_by":[],"changed":{"id":80229,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-f2wx-vrcx-jmvv","summary":"CGA-f2wx-vrcx-jmvv","evidence":"osv:CGA-f2wx-vrcx-jmvv","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f2wx-vrcx-jmvv","aliases":["CGA-f2wx-vrcx-jmvv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f2wx-vrcx-jmvv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:14Z"}]}}],"modified":"2026-10-03T17:25:23.033620019Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c7d63468-1c1d-4c68-910e-5fdd1aaf4ee1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f2wx-vrcx-jmvv","advisory_id":"c7d63468-1c1d-4c68-910e-5fdd1aaf4ee1","event_types":["advisory"],"published_at":"2026-10-26T12:03:29.297549+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:51+00:00","detail_url":"/events/80229"},"members":[{"id":80229,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-f2wx-vrcx-jmvv","summary":"CGA-f2wx-vrcx-jmvv","evidence":"osv:CGA-f2wx-vrcx-jmvv","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f2wx-vrcx-jmvv","aliases":["CGA-f2wx-vrcx-jmvv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f2wx-vrcx-jmvv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:14Z"}]}}],"modified":"2026-10-03T17:25:23.033620019Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c7d63468-1c1d-4c68-910e-5fdd1aaf4ee1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f2wx-vrcx-jmvv","advisory_id":"c7d63468-1c1d-4c68-910e-5fdd1aaf4ee1","event_types":["advisory"],"published_at":"2026-10-26T12:03:29.297549+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:51+00:00","detail_url":"/events/80229"}]}},{"id":74635,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-r78r-4246-rx9f","summary":"CGA-r78r-4246-rx9f","evidence":"osv:CGA-r78r-4246-rx9f","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r78r-4246-rx9f","aliases":["CGA-r78r-4246-rx9f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r78r-4246-rx9f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:06Z"}]}}],"modified":"2026-10-03T17:25:26.934610741Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e23bf908-5a3e-403e-a59c-7f03e79fe39a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r78r-4246-rx9f","advisory_id":"e23bf908-5a3e-403e-a59c-7f03e79fe39a","event_types":["advisory"],"published_at":"2026-10-26T11:57:12.799716+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:46+00:00","detail_url":"/advisories/advisory%3Ae23bf908-5a3e-403e-a59c-7f03e79fe39a","group":{"id":"advisory:e23bf908-5a3e-403e-a59c-7f03e79fe39a","revision":1,"primary_event_id":80191,"change":"published","superseded_by":[],"changed":{"id":80191,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-r78r-4246-rx9f","summary":"CGA-r78r-4246-rx9f","evidence":"osv:CGA-r78r-4246-rx9f","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r78r-4246-rx9f","aliases":["CGA-r78r-4246-rx9f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r78r-4246-rx9f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:06Z"}]}}],"modified":"2026-10-03T17:25:26.934610741Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e23bf908-5a3e-403e-a59c-7f03e79fe39a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r78r-4246-rx9f","advisory_id":"e23bf908-5a3e-403e-a59c-7f03e79fe39a","event_types":["advisory"],"published_at":"2026-10-26T11:57:12.799716+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:46+00:00","detail_url":"/events/80191"},"members":[{"id":80191,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-r78r-4246-rx9f","summary":"CGA-r78r-4246-rx9f","evidence":"osv:CGA-r78r-4246-rx9f","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r78r-4246-rx9f","aliases":["CGA-r78r-4246-rx9f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r78r-4246-rx9f.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:06Z"}]}}],"modified":"2026-10-03T17:25:26.934610741Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e23bf908-5a3e-403e-a59c-7f03e79fe39a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r78r-4246-rx9f","advisory_id":"e23bf908-5a3e-403e-a59c-7f03e79fe39a","event_types":["advisory"],"published_at":"2026-10-26T11:57:12.799716+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:46+00:00","detail_url":"/events/80191"}]}},{"id":74619,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-98mp-wxfq-q3j9","summary":"CGA-98mp-wxfq-q3j9","evidence":"osv:CGA-98mp-wxfq-q3j9","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-98mp-wxfq-q3j9","aliases":["CGA-98mp-wxfq-q3j9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98mp-wxfq-q3j9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:14Z"}]}}],"modified":"2026-10-03T17:25:20.283798944Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1b15aec3-2725-4722-96f7-603ab90d3fcb","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98mp-wxfq-q3j9","advisory_id":"1b15aec3-2725-4722-96f7-603ab90d3fcb","event_types":["advisory"],"published_at":"2026-10-26T11:51:19.179603+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:48+00:00","detail_url":"/advisories/advisory%3A1b15aec3-2725-4722-96f7-603ab90d3fcb","group":{"id":"advisory:1b15aec3-2725-4722-96f7-603ab90d3fcb","revision":1,"primary_event_id":80136,"change":"published","superseded_by":[],"changed":{"id":80136,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-98mp-wxfq-q3j9","summary":"CGA-98mp-wxfq-q3j9","evidence":"osv:CGA-98mp-wxfq-q3j9","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-98mp-wxfq-q3j9","aliases":["CGA-98mp-wxfq-q3j9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98mp-wxfq-q3j9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:14Z"}]}}],"modified":"2026-10-03T17:25:20.283798944Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1b15aec3-2725-4722-96f7-603ab90d3fcb","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98mp-wxfq-q3j9","advisory_id":"1b15aec3-2725-4722-96f7-603ab90d3fcb","event_types":["advisory"],"published_at":"2026-10-26T11:51:19.179603+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:48+00:00","detail_url":"/events/80136"},"members":[{"id":80136,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-98mp-wxfq-q3j9","summary":"CGA-98mp-wxfq-q3j9","evidence":"osv:CGA-98mp-wxfq-q3j9","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-98mp-wxfq-q3j9","aliases":["CGA-98mp-wxfq-q3j9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98mp-wxfq-q3j9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:14Z"}]}}],"modified":"2026-10-03T17:25:20.283798944Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1b15aec3-2725-4722-96f7-603ab90d3fcb","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98mp-wxfq-q3j9","advisory_id":"1b15aec3-2725-4722-96f7-603ab90d3fcb","event_types":["advisory"],"published_at":"2026-10-26T11:51:19.179603+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:48+00:00","detail_url":"/events/80136"}]}},{"id":74609,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-85r9-g5x2-8cjh","summary":"CGA-85r9-g5x2-8cjh","evidence":"osv:CGA-85r9-g5x2-8cjh","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-85r9-g5x2-8cjh","aliases":["CGA-85r9-g5x2-8cjh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-85r9-g5x2-8cjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:06Z"}]}}],"modified":"2026-10-03T17:25:18.976664668Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:05a3dc57-47e0-4ecb-988a-14ce0d3a9f10","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-85r9-g5x2-8cjh","advisory_id":"05a3dc57-47e0-4ecb-988a-14ce0d3a9f10","event_types":["advisory"],"published_at":"2026-10-26T11:47:19.431236+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:44+00:00","detail_url":"/advisories/advisory%3A05a3dc57-47e0-4ecb-988a-14ce0d3a9f10","group":{"id":"advisory:05a3dc57-47e0-4ecb-988a-14ce0d3a9f10","revision":1,"primary_event_id":80104,"change":"published","superseded_by":[],"changed":{"id":80104,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-85r9-g5x2-8cjh","summary":"CGA-85r9-g5x2-8cjh","evidence":"osv:CGA-85r9-g5x2-8cjh","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-85r9-g5x2-8cjh","aliases":["CGA-85r9-g5x2-8cjh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-85r9-g5x2-8cjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:06Z"}]}}],"modified":"2026-10-03T17:25:18.976664668Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:05a3dc57-47e0-4ecb-988a-14ce0d3a9f10","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-85r9-g5x2-8cjh","advisory_id":"05a3dc57-47e0-4ecb-988a-14ce0d3a9f10","event_types":["advisory"],"published_at":"2026-10-26T11:47:19.431236+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:44+00:00","detail_url":"/events/80104"},"members":[{"id":80104,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-85r9-g5x2-8cjh","summary":"CGA-85r9-g5x2-8cjh","evidence":"osv:CGA-85r9-g5x2-8cjh","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-85r9-g5x2-8cjh","aliases":["CGA-85r9-g5x2-8cjh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-85r9-g5x2-8cjh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:06Z"}]}}],"modified":"2026-10-03T17:25:18.976664668Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:05a3dc57-47e0-4ecb-988a-14ce0d3a9f10","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-85r9-g5x2-8cjh","advisory_id":"05a3dc57-47e0-4ecb-988a-14ce0d3a9f10","event_types":["advisory"],"published_at":"2026-10-26T11:47:19.431236+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:44+00:00","detail_url":"/events/80104"}]}},{"id":74595,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-6mjr-wgrq-8xgg","summary":"CGA-6mjr-wgrq-8xgg","evidence":"osv:CGA-6mjr-wgrq-8xgg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-6mjr-wgrq-8xgg","aliases":["CGA-6mjr-wgrq-8xgg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6mjr-wgrq-8xgg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:13.251037646Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4bbbbf43-a0d8-47e2-93bc-72279c2a7dad","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6mjr-wgrq-8xgg","advisory_id":"4bbbbf43-a0d8-47e2-93bc-72279c2a7dad","event_types":["advisory"],"published_at":"2026-10-26T11:39:19.067429+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:43+00:00","detail_url":"/advisories/advisory%3A4bbbbf43-a0d8-47e2-93bc-72279c2a7dad","group":{"id":"advisory:4bbbbf43-a0d8-47e2-93bc-72279c2a7dad","revision":1,"primary_event_id":80045,"change":"published","superseded_by":[],"changed":{"id":80045,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-6mjr-wgrq-8xgg","summary":"CGA-6mjr-wgrq-8xgg","evidence":"osv:CGA-6mjr-wgrq-8xgg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-6mjr-wgrq-8xgg","aliases":["CGA-6mjr-wgrq-8xgg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6mjr-wgrq-8xgg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:13.251037646Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4bbbbf43-a0d8-47e2-93bc-72279c2a7dad","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6mjr-wgrq-8xgg","advisory_id":"4bbbbf43-a0d8-47e2-93bc-72279c2a7dad","event_types":["advisory"],"published_at":"2026-10-26T11:39:19.067429+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:43+00:00","detail_url":"/events/80045"},"members":[{"id":80045,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-6mjr-wgrq-8xgg","summary":"CGA-6mjr-wgrq-8xgg","evidence":"osv:CGA-6mjr-wgrq-8xgg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-6mjr-wgrq-8xgg","aliases":["CGA-6mjr-wgrq-8xgg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6mjr-wgrq-8xgg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:13.251037646Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4bbbbf43-a0d8-47e2-93bc-72279c2a7dad","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6mjr-wgrq-8xgg","advisory_id":"4bbbbf43-a0d8-47e2-93bc-72279c2a7dad","event_types":["advisory"],"published_at":"2026-10-26T11:39:19.067429+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:43+00:00","detail_url":"/events/80045"}]}},{"id":74576,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-5jqf-wmxw-w58j","summary":"CGA-5jqf-wmxw-w58j","evidence":"osv:CGA-5jqf-wmxw-w58j","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5jqf-wmxw-w58j","aliases":["CGA-5jqf-wmxw-w58j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5jqf-wmxw-w58j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:08.473277288Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8075f13a-9b93-4232-9f3a-4eb5746459cf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5jqf-wmxw-w58j","advisory_id":"8075f13a-9b93-4232-9f3a-4eb5746459cf","event_types":["advisory"],"published_at":"2026-10-26T11:31:25.359646+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:46+00:00","detail_url":"/advisories/advisory%3A8075f13a-9b93-4232-9f3a-4eb5746459cf","group":{"id":"advisory:8075f13a-9b93-4232-9f3a-4eb5746459cf","revision":1,"primary_event_id":79978,"change":"published","superseded_by":[],"changed":{"id":79978,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-5jqf-wmxw-w58j","summary":"CGA-5jqf-wmxw-w58j","evidence":"osv:CGA-5jqf-wmxw-w58j","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5jqf-wmxw-w58j","aliases":["CGA-5jqf-wmxw-w58j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5jqf-wmxw-w58j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:08.473277288Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8075f13a-9b93-4232-9f3a-4eb5746459cf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5jqf-wmxw-w58j","advisory_id":"8075f13a-9b93-4232-9f3a-4eb5746459cf","event_types":["advisory"],"published_at":"2026-10-26T11:31:25.359646+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:46+00:00","detail_url":"/events/79978"},"members":[{"id":79978,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-5jqf-wmxw-w58j","summary":"CGA-5jqf-wmxw-w58j","evidence":"osv:CGA-5jqf-wmxw-w58j","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5jqf-wmxw-w58j","aliases":["CGA-5jqf-wmxw-w58j"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5jqf-wmxw-w58j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:25:08.473277288Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8075f13a-9b93-4232-9f3a-4eb5746459cf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5jqf-wmxw-w58j","advisory_id":"8075f13a-9b93-4232-9f3a-4eb5746459cf","event_types":["advisory"],"published_at":"2026-10-26T11:31:25.359646+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:46+00:00","detail_url":"/events/79978"}]}},{"id":74547,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-7rmq-532v-hf72","summary":"CGA-7rmq-532v-hf72","evidence":"osv:CGA-7rmq-532v-hf72","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7rmq-532v-hf72","aliases":["CGA-7rmq-532v-hf72"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7rmq-532v-hf72.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:06Z"}]}}],"modified":"2026-10-03T17:24:59.079687211Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bedbf0f5-be67-409d-85f9-cabd29ce4ed3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7rmq-532v-hf72","advisory_id":"bedbf0f5-be67-409d-85f9-cabd29ce4ed3","event_types":["advisory"],"published_at":"2026-10-26T11:14:28.603639+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:45+00:00","detail_url":"/advisories/advisory%3Abedbf0f5-be67-409d-85f9-cabd29ce4ed3","group":{"id":"advisory:bedbf0f5-be67-409d-85f9-cabd29ce4ed3","revision":1,"primary_event_id":79843,"change":"published","superseded_by":[],"changed":{"id":79843,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-7rmq-532v-hf72","summary":"CGA-7rmq-532v-hf72","evidence":"osv:CGA-7rmq-532v-hf72","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7rmq-532v-hf72","aliases":["CGA-7rmq-532v-hf72"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7rmq-532v-hf72.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:06Z"}]}}],"modified":"2026-10-03T17:24:59.079687211Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bedbf0f5-be67-409d-85f9-cabd29ce4ed3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7rmq-532v-hf72","advisory_id":"bedbf0f5-be67-409d-85f9-cabd29ce4ed3","event_types":["advisory"],"published_at":"2026-10-26T11:14:28.603639+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:45+00:00","detail_url":"/events/79843"},"members":[{"id":79843,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-7rmq-532v-hf72","summary":"CGA-7rmq-532v-hf72","evidence":"osv:CGA-7rmq-532v-hf72","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7rmq-532v-hf72","aliases":["CGA-7rmq-532v-hf72"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7rmq-532v-hf72.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:06Z"}]}}],"modified":"2026-10-03T17:24:59.079687211Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bedbf0f5-be67-409d-85f9-cabd29ce4ed3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7rmq-532v-hf72","advisory_id":"bedbf0f5-be67-409d-85f9-cabd29ce4ed3","event_types":["advisory"],"published_at":"2026-10-26T11:14:28.603639+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:45+00:00","detail_url":"/events/79843"}]}},{"id":74541,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-m79g-478c-82cp","summary":"CGA-m79g-478c-82cp","evidence":"osv:CGA-m79g-478c-82cp","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m79g-478c-82cp","aliases":["CGA-m79g-478c-82cp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m79g-478c-82cp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:11Z"}]}}],"modified":"2026-10-03T17:24:57.847747915Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a3e20043-3041-46c9-a564-f5599c2a3630","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m79g-478c-82cp","advisory_id":"a3e20043-3041-46c9-a564-f5599c2a3630","event_types":["advisory"],"published_at":"2026-10-26T11:13:56.500229+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:49+00:00","detail_url":"/advisories/advisory%3Aa3e20043-3041-46c9-a564-f5599c2a3630","group":{"id":"advisory:a3e20043-3041-46c9-a564-f5599c2a3630","revision":1,"primary_event_id":79834,"change":"published","superseded_by":[],"changed":{"id":79834,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-m79g-478c-82cp","summary":"CGA-m79g-478c-82cp","evidence":"osv:CGA-m79g-478c-82cp","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m79g-478c-82cp","aliases":["CGA-m79g-478c-82cp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m79g-478c-82cp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:11Z"}]}}],"modified":"2026-10-03T17:24:57.847747915Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a3e20043-3041-46c9-a564-f5599c2a3630","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m79g-478c-82cp","advisory_id":"a3e20043-3041-46c9-a564-f5599c2a3630","event_types":["advisory"],"published_at":"2026-10-26T11:13:56.500229+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:49+00:00","detail_url":"/events/79834"},"members":[{"id":79834,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-m79g-478c-82cp","summary":"CGA-m79g-478c-82cp","evidence":"osv:CGA-m79g-478c-82cp","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m79g-478c-82cp","aliases":["CGA-m79g-478c-82cp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m79g-478c-82cp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:11Z"}]}}],"modified":"2026-10-03T17:24:57.847747915Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a3e20043-3041-46c9-a564-f5599c2a3630","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m79g-478c-82cp","advisory_id":"a3e20043-3041-46c9-a564-f5599c2a3630","event_types":["advisory"],"published_at":"2026-10-26T11:13:56.500229+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:49+00:00","detail_url":"/events/79834"}]}},{"id":74524,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-79hx-gfrr-ppvg","summary":"CGA-79hx-gfrr-ppvg","evidence":"osv:CGA-79hx-gfrr-ppvg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-79hx-gfrr-ppvg","aliases":["CGA-79hx-gfrr-ppvg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-79hx-gfrr-ppvg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:24:53.732342652Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:447b96f6-aa59-44d9-bee3-dfe0a778993d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-79hx-gfrr-ppvg","advisory_id":"447b96f6-aa59-44d9-bee3-dfe0a778993d","event_types":["advisory"],"published_at":"2026-10-26T11:05:07.712065+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:45+00:00","detail_url":"/advisories/advisory%3A447b96f6-aa59-44d9-bee3-dfe0a778993d","group":{"id":"advisory:447b96f6-aa59-44d9-bee3-dfe0a778993d","revision":1,"primary_event_id":79750,"change":"published","superseded_by":[],"changed":{"id":79750,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-79hx-gfrr-ppvg","summary":"CGA-79hx-gfrr-ppvg","evidence":"osv:CGA-79hx-gfrr-ppvg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-79hx-gfrr-ppvg","aliases":["CGA-79hx-gfrr-ppvg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-79hx-gfrr-ppvg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:24:53.732342652Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:447b96f6-aa59-44d9-bee3-dfe0a778993d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-79hx-gfrr-ppvg","advisory_id":"447b96f6-aa59-44d9-bee3-dfe0a778993d","event_types":["advisory"],"published_at":"2026-10-26T11:05:07.712065+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:45+00:00","detail_url":"/events/79750"},"members":[{"id":79750,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-79hx-gfrr-ppvg","summary":"CGA-79hx-gfrr-ppvg","evidence":"osv:CGA-79hx-gfrr-ppvg","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-79hx-gfrr-ppvg","aliases":["CGA-79hx-gfrr-ppvg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-79hx-gfrr-ppvg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:24:53.732342652Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:447b96f6-aa59-44d9-bee3-dfe0a778993d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-79hx-gfrr-ppvg","advisory_id":"447b96f6-aa59-44d9-bee3-dfe0a778993d","event_types":["advisory"],"published_at":"2026-10-26T11:05:07.712065+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:45+00:00","detail_url":"/events/79750"}]}},{"id":74508,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-4f62-mcv6-9mmh","summary":"CGA-4f62-mcv6-9mmh","evidence":"osv:CGA-4f62-mcv6-9mmh","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4f62-mcv6-9mmh","aliases":["CGA-4f62-mcv6-9mmh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4f62-mcv6-9mmh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:24:50.930301588Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0a0fe143-85ba-4d09-9540-992bdb945194","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4f62-mcv6-9mmh","advisory_id":"0a0fe143-85ba-4d09-9540-992bdb945194","event_types":["advisory"],"published_at":"2026-10-26T10:59:24.511891+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:44+00:00","detail_url":"/advisories/advisory%3A0a0fe143-85ba-4d09-9540-992bdb945194","group":{"id":"advisory:0a0fe143-85ba-4d09-9540-992bdb945194","revision":1,"primary_event_id":79698,"change":"published","superseded_by":[],"changed":{"id":79698,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-4f62-mcv6-9mmh","summary":"CGA-4f62-mcv6-9mmh","evidence":"osv:CGA-4f62-mcv6-9mmh","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4f62-mcv6-9mmh","aliases":["CGA-4f62-mcv6-9mmh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4f62-mcv6-9mmh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:24:50.930301588Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0a0fe143-85ba-4d09-9540-992bdb945194","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4f62-mcv6-9mmh","advisory_id":"0a0fe143-85ba-4d09-9540-992bdb945194","event_types":["advisory"],"published_at":"2026-10-26T10:59:24.511891+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:44+00:00","detail_url":"/events/79698"},"members":[{"id":79698,"cve_ids":["CVE-2026-68497"],"payload":{"kind":"advisory","title":"CGA-4f62-mcv6-9mmh","summary":"CGA-4f62-mcv6-9mmh","evidence":"osv:CGA-4f62-mcv6-9mmh","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4f62-mcv6-9mmh","aliases":["CGA-4f62-mcv6-9mmh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4f62-mcv6-9mmh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:30:07Z"}]}}],"modified":"2026-10-03T17:24:50.930301588Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0a0fe143-85ba-4d09-9540-992bdb945194","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4f62-mcv6-9mmh","advisory_id":"0a0fe143-85ba-4d09-9540-992bdb945194","event_types":["advisory"],"published_at":"2026-10-26T10:59:24.511891+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:06:44+00:00","detail_url":"/events/79698"}]}},{"id":74487,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-2gwf-68mx-f6pp","summary":"CGA-2gwf-68mx-f6pp","evidence":"osv:CGA-2gwf-68mx-f6pp","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2gwf-68mx-f6pp","aliases":["CGA-2gwf-68mx-f6pp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2gwf-68mx-f6pp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:10Z"}]}}],"modified":"2026-10-03T17:24:45.113268552Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f2e40477-69ed-40ec-95df-94a73d1c2f30","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2gwf-68mx-f6pp","advisory_id":"f2e40477-69ed-40ec-95df-94a73d1c2f30","event_types":["advisory"],"published_at":"2026-10-26T10:53:11.663023+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:53+00:00","detail_url":"/advisories/advisory%3Af2e40477-69ed-40ec-95df-94a73d1c2f30","group":{"id":"advisory:f2e40477-69ed-40ec-95df-94a73d1c2f30","revision":1,"primary_event_id":79644,"change":"published","superseded_by":[],"changed":{"id":79644,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-2gwf-68mx-f6pp","summary":"CGA-2gwf-68mx-f6pp","evidence":"osv:CGA-2gwf-68mx-f6pp","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2gwf-68mx-f6pp","aliases":["CGA-2gwf-68mx-f6pp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2gwf-68mx-f6pp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:10Z"}]}}],"modified":"2026-10-03T17:24:45.113268552Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f2e40477-69ed-40ec-95df-94a73d1c2f30","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2gwf-68mx-f6pp","advisory_id":"f2e40477-69ed-40ec-95df-94a73d1c2f30","event_types":["advisory"],"published_at":"2026-10-26T10:53:11.663023+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:53+00:00","detail_url":"/events/79644"},"members":[{"id":79644,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-2gwf-68mx-f6pp","summary":"CGA-2gwf-68mx-f6pp","evidence":"osv:CGA-2gwf-68mx-f6pp","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2gwf-68mx-f6pp","aliases":["CGA-2gwf-68mx-f6pp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2gwf-68mx-f6pp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:10Z"}]}}],"modified":"2026-10-03T17:24:45.113268552Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f2e40477-69ed-40ec-95df-94a73d1c2f30","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2gwf-68mx-f6pp","advisory_id":"f2e40477-69ed-40ec-95df-94a73d1c2f30","event_types":["advisory"],"published_at":"2026-10-26T10:53:11.663023+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:53+00:00","detail_url":"/events/79644"}]}},{"id":74485,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-25qx-mw9v-6fff","summary":"CGA-25qx-mw9v-6fff","evidence":"osv:CGA-25qx-mw9v-6fff","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-25qx-mw9v-6fff","aliases":["CGA-25qx-mw9v-6fff"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-25qx-mw9v-6fff.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:11Z"}]}}],"modified":"2026-10-03T17:24:44.348983287Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:24e8c090-45a0-4076-8358-04255b51a636","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-25qx-mw9v-6fff","advisory_id":"24e8c090-45a0-4076-8358-04255b51a636","event_types":["advisory"],"published_at":"2026-10-26T10:52:59.116244+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:50+00:00","detail_url":"/advisories/advisory%3A24e8c090-45a0-4076-8358-04255b51a636","group":{"id":"advisory:24e8c090-45a0-4076-8358-04255b51a636","revision":1,"primary_event_id":79641,"change":"published","superseded_by":[],"changed":{"id":79641,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-25qx-mw9v-6fff","summary":"CGA-25qx-mw9v-6fff","evidence":"osv:CGA-25qx-mw9v-6fff","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-25qx-mw9v-6fff","aliases":["CGA-25qx-mw9v-6fff"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-25qx-mw9v-6fff.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:11Z"}]}}],"modified":"2026-10-03T17:24:44.348983287Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:24e8c090-45a0-4076-8358-04255b51a636","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-25qx-mw9v-6fff","advisory_id":"24e8c090-45a0-4076-8358-04255b51a636","event_types":["advisory"],"published_at":"2026-10-26T10:52:59.116244+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:50+00:00","detail_url":"/events/79641"},"members":[{"id":79641,"cve_ids":["CVE-2026-83557"],"payload":{"kind":"advisory","title":"CGA-25qx-mw9v-6fff","summary":"CGA-25qx-mw9v-6fff","evidence":"osv:CGA-25qx-mw9v-6fff","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-25qx-mw9v-6fff","aliases":["CGA-25qx-mw9v-6fff"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-25qx-mw9v-6fff.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:33:11Z"}]}}],"modified":"2026-10-03T17:24:44.348983287Z","provider":"osv","upstream":["CVE-2026-83557","GHSA-gx83-3vf8-gh7j"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-83557","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:24e8c090-45a0-4076-8358-04255b51a636","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-25qx-mw9v-6fff","advisory_id":"24e8c090-45a0-4076-8358-04255b51a636","event_types":["advisory"],"published_at":"2026-10-26T10:52:59.116244+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:19:50+00:00","detail_url":"/events/79641"}]}},{"id":73762,"cve_ids":["CVE-2026-68494"],"payload":{"kind":"advisory","title":"CGA-9g37-g3f7-7x4x","summary":"CGA-9g37-g3f7-7x4x","evidence":"osv:CGA-9g37-g3f7-7x4x","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9g37-g3f7-7x4x","aliases":["CGA-9g37-g3f7-7x4x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.1-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9g37-g3f7-7x4x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.2","component_type":"java-archive","component_version":"2.21.2","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-integration-kafka-12.1.3-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-core/2.21.2/jackson-core-2.21.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-08-19T19:05:47Z"}]}}],"modified":"2026-10-03T16:12:45.702255105Z","provider":"osv","upstream":["CVE-2026-68494","GHSA-642r-3gj9-2pj5","GHSA-r7wm-3cxj-wff9"],"references":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"]},"related_cves":[{"value":"CVE-2026-68494","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a92dc822-9f08-407c-ac50-0431fbab833f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9g37-g3f7-7x4x","advisory_id":"a92dc822-9f08-407c-ac50-0431fbab833f","event_types":["advisory"],"published_at":"2026-10-26T04:45:45.053489+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-05T02:48:10+00:00","detail_url":"/advisories/advisory%3Aa92dc822-9f08-407c-ac50-0431fbab833f","group":{"id":"advisory:a92dc822-9f08-407c-ac50-0431fbab833f","revision":1,"primary_event_id":76183,"change":"published","superseded_by":[],"changed":{"id":76183,"cve_ids":["CVE-2026-68494"],"payload":{"kind":"advisory","title":"CGA-9g37-g3f7-7x4x","summary":"CGA-9g37-g3f7-7x4x","evidence":"osv:CGA-9g37-g3f7-7x4x","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9g37-g3f7-7x4x","aliases":["CGA-9g37-g3f7-7x4x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.1-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9g37-g3f7-7x4x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.2","component_type":"java-archive","component_version":"2.21.2","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-integration-kafka-12.1.3-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-core/2.21.2/jackson-core-2.21.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-08-19T19:05:47Z"}]}}],"modified":"2026-10-03T16:12:45.702255105Z","provider":"osv","upstream":["CVE-2026-68494","GHSA-642r-3gj9-2pj5","GHSA-r7wm-3cxj-wff9"],"references":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"]},"related_cves":[{"value":"CVE-2026-68494","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a92dc822-9f08-407c-ac50-0431fbab833f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9g37-g3f7-7x4x","advisory_id":"a92dc822-9f08-407c-ac50-0431fbab833f","event_types":["advisory"],"published_at":"2026-10-26T04:45:45.053489+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-05T02:48:10+00:00","detail_url":"/events/76183"},"members":[{"id":76183,"cve_ids":["CVE-2026-68494"],"payload":{"kind":"advisory","title":"CGA-9g37-g3f7-7x4x","summary":"CGA-9g37-g3f7-7x4x","evidence":"osv:CGA-9g37-g3f7-7x4x","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9g37-g3f7-7x4x","aliases":["CGA-9g37-g3f7-7x4x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.1-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9g37-g3f7-7x4x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.2","component_type":"java-archive","component_version":"2.21.2","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-integration-kafka-12.1.3-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-core/2.21.2/jackson-core-2.21.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-08-19T19:05:47Z"}]}}],"modified":"2026-10-03T16:12:45.702255105Z","provider":"osv","upstream":["CVE-2026-68494","GHSA-642r-3gj9-2pj5","GHSA-r7wm-3cxj-wff9"],"references":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"]},"related_cves":[{"value":"CVE-2026-68494","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a92dc822-9f08-407c-ac50-0431fbab833f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9g37-g3f7-7x4x","advisory_id":"a92dc822-9f08-407c-ac50-0431fbab833f","event_types":["advisory"],"published_at":"2026-10-26T04:45:45.053489+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-05T02:48:10+00:00","detail_url":"/events/76183"}]}},{"id":73642,"cve_ids":["CVE-2026-68494"],"payload":{"kind":"advisory","title":"CGA-vx9c-734r-c8f5","summary":"CGA-vx9c-734r-c8f5","evidence":"osv:CGA-vx9c-734r-c8f5","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vx9c-734r-c8f5","aliases":["CGA-vx9c-734r-c8f5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.1-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vx9c-734r-c8f5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.15.0","component_type":"java-archive","component_version":"2.15.0","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.3-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.3/logstash-filter-elastic_integration-9.4.3.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-08-19T20:16:14Z"}]}}],"modified":"2026-10-03T16:12:43.203283180Z","provider":"osv","upstream":["CVE-2026-68494","GHSA-642r-3gj9-2pj5","GHSA-r7wm-3cxj-wff9"],"references":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"]},"related_cves":[{"value":"CVE-2026-68494","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fbc4e9da-3319-4bef-af1c-e3157380e071","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vx9c-734r-c8f5","advisory_id":"fbc4e9da-3319-4bef-af1c-e3157380e071","event_types":["advisory"],"published_at":"2026-10-26T04:38:57.331708+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-05T04:23:11+00:00","detail_url":"/advisories/advisory%3Afbc4e9da-3319-4bef-af1c-e3157380e071","group":{"id":"advisory:fbc4e9da-3319-4bef-af1c-e3157380e071","revision":1,"primary_event_id":76048,"change":"published","superseded_by":[],"changed":{"id":76048,"cve_ids":["CVE-2026-68494"],"payload":{"kind":"advisory","title":"CGA-vx9c-734r-c8f5","summary":"CGA-vx9c-734r-c8f5","evidence":"osv:CGA-vx9c-734r-c8f5","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vx9c-734r-c8f5","aliases":["CGA-vx9c-734r-c8f5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.1-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vx9c-734r-c8f5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.15.0","component_type":"java-archive","component_version":"2.15.0","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.3-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.3/logstash-filter-elastic_integration-9.4.3.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-08-19T20:16:14Z"}]}}],"modified":"2026-10-03T16:12:43.203283180Z","provider":"osv","upstream":["CVE-2026-68494","GHSA-642r-3gj9-2pj5","GHSA-r7wm-3cxj-wff9"],"references":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"]},"related_cves":[{"value":"CVE-2026-68494","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fbc4e9da-3319-4bef-af1c-e3157380e071","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vx9c-734r-c8f5","advisory_id":"fbc4e9da-3319-4bef-af1c-e3157380e071","event_types":["advisory"],"published_at":"2026-10-26T04:38:57.331708+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-05T04:23:11+00:00","detail_url":"/events/76048"},"members":[{"id":76048,"cve_ids":["CVE-2026-68494"],"payload":{"kind":"advisory","title":"CGA-vx9c-734r-c8f5","summary":"CGA-vx9c-734r-c8f5","evidence":"osv:CGA-vx9c-734r-c8f5","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vx9c-734r-c8f5","aliases":["CGA-vx9c-734r-c8f5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.1-r3"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vx9c-734r-c8f5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.15.0","component_type":"java-archive","component_version":"2.15.0","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.3-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.3/logstash-filter-elastic_integration-9.4.3.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-08-19T20:16:14Z"}]}}],"modified":"2026-10-03T16:12:43.203283180Z","provider":"osv","upstream":["CVE-2026-68494","GHSA-642r-3gj9-2pj5","GHSA-r7wm-3cxj-wff9"],"references":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"]},"related_cves":[{"value":"CVE-2026-68494","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fbc4e9da-3319-4bef-af1c-e3157380e071","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vx9c-734r-c8f5","advisory_id":"fbc4e9da-3319-4bef-af1c-e3157380e071","event_types":["advisory"],"published_at":"2026-10-26T04:38:57.331708+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-05T04:23:11+00:00","detail_url":"/events/76048"}]}},{"id":72221,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-j672-gwjw-mww4","summary":"CGA-j672-gwjw-mww4","evidence":"osv:CGA-j672-gwjw-mww4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-j672-gwjw-mww4","aliases":["CGA-j672-gwjw-mww4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j672-gwjw-mww4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:12Z"}]}}],"modified":"2026-10-02T23:01:36.439545353Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7ce20eae-0b57-4eef-ae99-9dc2c0b72c81","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j672-gwjw-mww4","advisory_id":"7ce20eae-0b57-4eef-ae99-9dc2c0b72c81","event_types":["advisory"],"published_at":"2026-10-26T00:18:56.998392+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:18+00:00","detail_url":"/advisories/advisory%3A7ce20eae-0b57-4eef-ae99-9dc2c0b72c81","group":{"id":"advisory:7ce20eae-0b57-4eef-ae99-9dc2c0b72c81","revision":1,"primary_event_id":72866,"change":"published","superseded_by":[],"changed":{"id":72866,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-j672-gwjw-mww4","summary":"CGA-j672-gwjw-mww4","evidence":"osv:CGA-j672-gwjw-mww4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-j672-gwjw-mww4","aliases":["CGA-j672-gwjw-mww4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j672-gwjw-mww4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:12Z"}]}}],"modified":"2026-10-02T23:01:36.439545353Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7ce20eae-0b57-4eef-ae99-9dc2c0b72c81","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j672-gwjw-mww4","advisory_id":"7ce20eae-0b57-4eef-ae99-9dc2c0b72c81","event_types":["advisory"],"published_at":"2026-10-26T00:18:56.998392+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:18+00:00","detail_url":"/events/72866"},"members":[{"id":72866,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-j672-gwjw-mww4","summary":"CGA-j672-gwjw-mww4","evidence":"osv:CGA-j672-gwjw-mww4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-j672-gwjw-mww4","aliases":["CGA-j672-gwjw-mww4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j672-gwjw-mww4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:12Z"}]}}],"modified":"2026-10-02T23:01:36.439545353Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7ce20eae-0b57-4eef-ae99-9dc2c0b72c81","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j672-gwjw-mww4","advisory_id":"7ce20eae-0b57-4eef-ae99-9dc2c0b72c81","event_types":["advisory"],"published_at":"2026-10-26T00:18:56.998392+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:18+00:00","detail_url":"/events/72866"}]}},{"id":72073,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-wh94-2vqx-q7m4","summary":"CGA-wh94-2vqx-q7m4","evidence":"osv:CGA-wh94-2vqx-q7m4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wh94-2vqx-q7m4","aliases":["CGA-wh94-2vqx-q7m4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh94-2vqx-q7m4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:10Z"}]}}],"modified":"2026-10-02T23:01:51.515598774Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:46cb30f0-1093-42d7-880e-8f4def39e827","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh94-2vqx-q7m4","advisory_id":"46cb30f0-1093-42d7-880e-8f4def39e827","event_types":["advisory"],"published_at":"2026-10-26T00:15:19.764429+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:17+00:00","detail_url":"/advisories/advisory%3A46cb30f0-1093-42d7-880e-8f4def39e827","group":{"id":"advisory:46cb30f0-1093-42d7-880e-8f4def39e827","revision":1,"primary_event_id":72702,"change":"published","superseded_by":[],"changed":{"id":72702,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-wh94-2vqx-q7m4","summary":"CGA-wh94-2vqx-q7m4","evidence":"osv:CGA-wh94-2vqx-q7m4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wh94-2vqx-q7m4","aliases":["CGA-wh94-2vqx-q7m4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh94-2vqx-q7m4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:10Z"}]}}],"modified":"2026-10-02T23:01:51.515598774Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:46cb30f0-1093-42d7-880e-8f4def39e827","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh94-2vqx-q7m4","advisory_id":"46cb30f0-1093-42d7-880e-8f4def39e827","event_types":["advisory"],"published_at":"2026-10-26T00:15:19.764429+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:17+00:00","detail_url":"/events/72702"},"members":[{"id":72702,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-wh94-2vqx-q7m4","summary":"CGA-wh94-2vqx-q7m4","evidence":"osv:CGA-wh94-2vqx-q7m4","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wh94-2vqx-q7m4","aliases":["CGA-wh94-2vqx-q7m4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh94-2vqx-q7m4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:10Z"}]}}],"modified":"2026-10-02T23:01:51.515598774Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:46cb30f0-1093-42d7-880e-8f4def39e827","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh94-2vqx-q7m4","advisory_id":"46cb30f0-1093-42d7-880e-8f4def39e827","event_types":["advisory"],"published_at":"2026-10-26T00:15:19.764429+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:17+00:00","detail_url":"/events/72702"}]}},{"id":72006,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-mh4r-9383-j3fh","summary":"CGA-mh4r-9383-j3fh","evidence":"osv:CGA-mh4r-9383-j3fh","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mh4r-9383-j3fh","aliases":["CGA-mh4r-9383-j3fh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mh4r-9383-j3fh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:58:01Z"}]}}],"modified":"2026-10-02T23:01:39.552896257Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:57fb6e81-82a2-47da-b7f2-fff342365bbe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mh4r-9383-j3fh","advisory_id":"57fb6e81-82a2-47da-b7f2-fff342365bbe","event_types":["advisory"],"published_at":"2026-10-26T00:07:16.334871+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:48+00:00","detail_url":"/advisories/advisory%3A57fb6e81-82a2-47da-b7f2-fff342365bbe","group":{"id":"advisory:57fb6e81-82a2-47da-b7f2-fff342365bbe","revision":1,"primary_event_id":72592,"change":"published","superseded_by":[],"changed":{"id":72592,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-mh4r-9383-j3fh","summary":"CGA-mh4r-9383-j3fh","evidence":"osv:CGA-mh4r-9383-j3fh","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mh4r-9383-j3fh","aliases":["CGA-mh4r-9383-j3fh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mh4r-9383-j3fh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:58:01Z"}]}}],"modified":"2026-10-02T23:01:39.552896257Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:57fb6e81-82a2-47da-b7f2-fff342365bbe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mh4r-9383-j3fh","advisory_id":"57fb6e81-82a2-47da-b7f2-fff342365bbe","event_types":["advisory"],"published_at":"2026-10-26T00:07:16.334871+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:48+00:00","detail_url":"/events/72592"},"members":[{"id":72592,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-mh4r-9383-j3fh","summary":"CGA-mh4r-9383-j3fh","evidence":"osv:CGA-mh4r-9383-j3fh","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mh4r-9383-j3fh","aliases":["CGA-mh4r-9383-j3fh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mh4r-9383-j3fh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-input-azure_event_hubs-1.5.8/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:58:01Z"}]}}],"modified":"2026-10-02T23:01:39.552896257Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:57fb6e81-82a2-47da-b7f2-fff342365bbe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mh4r-9383-j3fh","advisory_id":"57fb6e81-82a2-47da-b7f2-fff342365bbe","event_types":["advisory"],"published_at":"2026-10-26T00:07:16.334871+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:48+00:00","detail_url":"/events/72592"}]}},{"id":72002,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-mg52-489h-jr47","summary":"CGA-mg52-489h-jr47","evidence":"osv:CGA-mg52-489h-jr47","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mg52-489h-jr47","aliases":["CGA-mg52-489h-jr47"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mg52-489h-jr47.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:57:59Z"}]}}],"modified":"2026-10-02T23:01:37.731297063Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5a2cd791-6f6f-4ff1-af7d-47d9776a1974","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mg52-489h-jr47","advisory_id":"5a2cd791-6f6f-4ff1-af7d-47d9776a1974","event_types":["advisory"],"published_at":"2026-10-26T00:06:47.266579+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:48+00:00","detail_url":"/advisories/advisory%3A5a2cd791-6f6f-4ff1-af7d-47d9776a1974","group":{"id":"advisory:5a2cd791-6f6f-4ff1-af7d-47d9776a1974","revision":1,"primary_event_id":72588,"change":"published","superseded_by":[],"changed":{"id":72588,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-mg52-489h-jr47","summary":"CGA-mg52-489h-jr47","evidence":"osv:CGA-mg52-489h-jr47","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mg52-489h-jr47","aliases":["CGA-mg52-489h-jr47"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mg52-489h-jr47.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:57:59Z"}]}}],"modified":"2026-10-02T23:01:37.731297063Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5a2cd791-6f6f-4ff1-af7d-47d9776a1974","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mg52-489h-jr47","advisory_id":"5a2cd791-6f6f-4ff1-af7d-47d9776a1974","event_types":["advisory"],"published_at":"2026-10-26T00:06:47.266579+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:48+00:00","detail_url":"/events/72588"},"members":[{"id":72588,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-mg52-489h-jr47","summary":"CGA-mg52-489h-jr47","evidence":"osv:CGA-mg52-489h-jr47","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mg52-489h-jr47","aliases":["CGA-mg52-489h-jr47"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mg52-489h-jr47.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:57:59Z"}]}}],"modified":"2026-10-02T23:01:37.731297063Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5a2cd791-6f6f-4ff1-af7d-47d9776a1974","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mg52-489h-jr47","advisory_id":"5a2cd791-6f6f-4ff1-af7d-47d9776a1974","event_types":["advisory"],"published_at":"2026-10-26T00:06:47.266579+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:48+00:00","detail_url":"/events/72588"}]}},{"id":71996,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-qhqg-3g2x-h3h5","summary":"CGA-qhqg-3g2x-h3h5","evidence":"osv:CGA-qhqg-3g2x-h3h5","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-qhqg-3g2x-h3h5","aliases":["CGA-qhqg-3g2x-h3h5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qhqg-3g2x-h3h5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-integration-kafka-12.1.7-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.6/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}}],"modified":"2026-10-02T23:01:44.847906823Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a7eb1a40-0974-4f8c-86b7-df619105f5a8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qhqg-3g2x-h3h5","advisory_id":"a7eb1a40-0974-4f8c-86b7-df619105f5a8","event_types":["advisory"],"published_at":"2026-10-26T00:05:47.232139+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:19+00:00","detail_url":"/advisories/advisory%3Aa7eb1a40-0974-4f8c-86b7-df619105f5a8","group":{"id":"advisory:a7eb1a40-0974-4f8c-86b7-df619105f5a8","revision":1,"primary_event_id":72580,"change":"published","superseded_by":[],"changed":{"id":72580,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-qhqg-3g2x-h3h5","summary":"CGA-qhqg-3g2x-h3h5","evidence":"osv:CGA-qhqg-3g2x-h3h5","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-qhqg-3g2x-h3h5","aliases":["CGA-qhqg-3g2x-h3h5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qhqg-3g2x-h3h5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-integration-kafka-12.1.7-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.6/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}}],"modified":"2026-10-02T23:01:44.847906823Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a7eb1a40-0974-4f8c-86b7-df619105f5a8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qhqg-3g2x-h3h5","advisory_id":"a7eb1a40-0974-4f8c-86b7-df619105f5a8","event_types":["advisory"],"published_at":"2026-10-26T00:05:47.232139+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:19+00:00","detail_url":"/events/72580"},"members":[{"id":72580,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-qhqg-3g2x-h3h5","summary":"CGA-qhqg-3g2x-h3h5","evidence":"osv:CGA-qhqg-3g2x-h3h5","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-qhqg-3g2x-h3h5","aliases":["CGA-qhqg-3g2x-h3h5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qhqg-3g2x-h3h5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-integration-kafka-12.1.7-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.6/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}}],"modified":"2026-10-02T23:01:44.847906823Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a7eb1a40-0974-4f8c-86b7-df619105f5a8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qhqg-3g2x-h3h5","advisory_id":"a7eb1a40-0974-4f8c-86b7-df619105f5a8","event_types":["advisory"],"published_at":"2026-10-26T00:05:47.232139+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:19+00:00","detail_url":"/events/72580"}]}},{"id":71986,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-vgjv-fpjc-cpcj","summary":"CGA-vgjv-fpjc-cpcj","evidence":"osv:CGA-vgjv-fpjc-cpcj","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vgjv-fpjc-cpcj","aliases":["CGA-vgjv-fpjc-cpcj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgjv-fpjc-cpcj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}}],"modified":"2026-10-02T23:01:48.678669917Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9073d7bf-93a5-428f-9ba6-b777b2fa1788","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vgjv-fpjc-cpcj","advisory_id":"9073d7bf-93a5-428f-9ba6-b777b2fa1788","event_types":["advisory"],"published_at":"2026-10-26T00:04:08.120772+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:17+00:00","detail_url":"/advisories/advisory%3A9073d7bf-93a5-428f-9ba6-b777b2fa1788","group":{"id":"advisory:9073d7bf-93a5-428f-9ba6-b777b2fa1788","revision":1,"primary_event_id":72564,"change":"published","superseded_by":[],"changed":{"id":72564,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-vgjv-fpjc-cpcj","summary":"CGA-vgjv-fpjc-cpcj","evidence":"osv:CGA-vgjv-fpjc-cpcj","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vgjv-fpjc-cpcj","aliases":["CGA-vgjv-fpjc-cpcj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgjv-fpjc-cpcj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}}],"modified":"2026-10-02T23:01:48.678669917Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9073d7bf-93a5-428f-9ba6-b777b2fa1788","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vgjv-fpjc-cpcj","advisory_id":"9073d7bf-93a5-428f-9ba6-b777b2fa1788","event_types":["advisory"],"published_at":"2026-10-26T00:04:08.120772+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:17+00:00","detail_url":"/events/72564"},"members":[{"id":72564,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-vgjv-fpjc-cpcj","summary":"CGA-vgjv-fpjc-cpcj","evidence":"osv:CGA-vgjv-fpjc-cpcj","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vgjv-fpjc-cpcj","aliases":["CGA-vgjv-fpjc-cpcj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgjv-fpjc-cpcj.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:45:08Z"}]}}],"modified":"2026-10-02T23:01:48.678669917Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9073d7bf-93a5-428f-9ba6-b777b2fa1788","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vgjv-fpjc-cpcj","advisory_id":"9073d7bf-93a5-428f-9ba6-b777b2fa1788","event_types":["advisory"],"published_at":"2026-10-26T00:04:08.120772+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:51:17+00:00","detail_url":"/events/72564"}]}}],"next_after":74738,"next_before":71986}