{"schema_version":"2","view":"grouped","data":[{"id":71079,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-2w57-j885-25pq","summary":"CGA-2w57-j885-25pq","evidence":"osv:CGA-2w57-j885-25pq","products":[{"name":{"value":"apache-pulsar-4.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.13-r9","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2w57-j885-25pq","aliases":["CGA-2w57-j885-25pq"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.13-r9"}]}],"package":{"name":"apache-pulsar-4.0","purl":"pkg:apk/chainguard/apache-pulsar-4.0?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2w57-j885-25pq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/java/pulsar/lib/org.apache.pulsar-bouncy-castle-bc-4.0.13-pkg.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:50:20Z"}]}}],"modified":"2026-10-02T23:00:13.544598665Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7f6cc504-ac90-446a-acc1-9ffdeb8ef750","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2w57-j885-25pq","advisory_id":"7f6cc504-ac90-446a-acc1-9ffdeb8ef750","event_types":["advisory"],"published_at":"2026-10-25T22:49:39.801247+00:00","technologies":["apache-pulsar-4-0","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:02:06+00:00","detail_url":"/advisories/advisory%3A7f6cc504-ac90-446a-acc1-9ffdeb8ef750","group":{"id":"advisory:7f6cc504-ac90-446a-acc1-9ffdeb8ef750","revision":1,"primary_event_id":71453,"change":"published","superseded_by":[],"changed":{"id":71453,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-2w57-j885-25pq","summary":"CGA-2w57-j885-25pq","evidence":"osv:CGA-2w57-j885-25pq","products":[{"name":{"value":"apache-pulsar-4.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.13-r9","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2w57-j885-25pq","aliases":["CGA-2w57-j885-25pq"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.13-r9"}]}],"package":{"name":"apache-pulsar-4.0","purl":"pkg:apk/chainguard/apache-pulsar-4.0?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2w57-j885-25pq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/java/pulsar/lib/org.apache.pulsar-bouncy-castle-bc-4.0.13-pkg.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:50:20Z"}]}}],"modified":"2026-10-02T23:00:13.544598665Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7f6cc504-ac90-446a-acc1-9ffdeb8ef750","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2w57-j885-25pq","advisory_id":"7f6cc504-ac90-446a-acc1-9ffdeb8ef750","event_types":["advisory"],"published_at":"2026-10-25T22:49:39.801247+00:00","technologies":["apache-pulsar-4-0","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:02:06+00:00","detail_url":"/events/71453"},"members":[{"id":71453,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-2w57-j885-25pq","summary":"CGA-2w57-j885-25pq","evidence":"osv:CGA-2w57-j885-25pq","products":[{"name":{"value":"apache-pulsar-4.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.13-r9","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2w57-j885-25pq","aliases":["CGA-2w57-j885-25pq"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.13-r9"}]}],"package":{"name":"apache-pulsar-4.0","purl":"pkg:apk/chainguard/apache-pulsar-4.0?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2w57-j885-25pq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/java/pulsar/lib/org.apache.pulsar-bouncy-castle-bc-4.0.13-pkg.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:50:20Z"}]}}],"modified":"2026-10-02T23:00:13.544598665Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7f6cc504-ac90-446a-acc1-9ffdeb8ef750","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2w57-j885-25pq","advisory_id":"7f6cc504-ac90-446a-acc1-9ffdeb8ef750","event_types":["advisory"],"published_at":"2026-10-25T22:49:39.801247+00:00","technologies":["apache-pulsar-4-0","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:02:06+00:00","detail_url":"/events/71453"}]}},{"id":71078,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3hvh-w8p8-v789","summary":"CGA-3hvh-w8p8-v789","evidence":"osv:CGA-3hvh-w8p8-v789","products":[{"name":{"value":"request-9047-keycloak-fips-26.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"26.5.7-r31","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3hvh-w8p8-v789","aliases":["CGA-3hvh-w8p8-v789"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.5.7-r31"}]}],"package":{"name":"request-9047-keycloak-fips-26.5","purl":"pkg:apk/chainguard/request-9047-keycloak-fips-26.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hvh-w8p8-v789.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/keycloak/lib/lib/main/com.fasterxml.jackson.core.jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:21:09Z"}]}}],"modified":"2026-10-02T23:00:13.539792299Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:39f819ce-205d-4c7f-aef4-8191a740264f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hvh-w8p8-v789","advisory_id":"39f819ce-205d-4c7f-aef4-8191a740264f","event_types":["advisory"],"published_at":"2026-10-25T22:49:38.063236+00:00","technologies":["core-osv","request-9047-keycloak-fips-26-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:31+00:00","detail_url":"/advisories/advisory%3A39f819ce-205d-4c7f-aef4-8191a740264f","group":{"id":"advisory:39f819ce-205d-4c7f-aef4-8191a740264f","revision":1,"primary_event_id":71452,"change":"published","superseded_by":[],"changed":{"id":71452,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3hvh-w8p8-v789","summary":"CGA-3hvh-w8p8-v789","evidence":"osv:CGA-3hvh-w8p8-v789","products":[{"name":{"value":"request-9047-keycloak-fips-26.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"26.5.7-r31","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3hvh-w8p8-v789","aliases":["CGA-3hvh-w8p8-v789"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.5.7-r31"}]}],"package":{"name":"request-9047-keycloak-fips-26.5","purl":"pkg:apk/chainguard/request-9047-keycloak-fips-26.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hvh-w8p8-v789.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/keycloak/lib/lib/main/com.fasterxml.jackson.core.jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:21:09Z"}]}}],"modified":"2026-10-02T23:00:13.539792299Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:39f819ce-205d-4c7f-aef4-8191a740264f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hvh-w8p8-v789","advisory_id":"39f819ce-205d-4c7f-aef4-8191a740264f","event_types":["advisory"],"published_at":"2026-10-25T22:49:38.063236+00:00","technologies":["core-osv","request-9047-keycloak-fips-26-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:31+00:00","detail_url":"/events/71452"},"members":[{"id":71452,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3hvh-w8p8-v789","summary":"CGA-3hvh-w8p8-v789","evidence":"osv:CGA-3hvh-w8p8-v789","products":[{"name":{"value":"request-9047-keycloak-fips-26.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"26.5.7-r31","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3hvh-w8p8-v789","aliases":["CGA-3hvh-w8p8-v789"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.5.7-r31"}]}],"package":{"name":"request-9047-keycloak-fips-26.5","purl":"pkg:apk/chainguard/request-9047-keycloak-fips-26.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hvh-w8p8-v789.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/keycloak/lib/lib/main/com.fasterxml.jackson.core.jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:21:09Z"}]}}],"modified":"2026-10-02T23:00:13.539792299Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:39f819ce-205d-4c7f-aef4-8191a740264f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hvh-w8p8-v789","advisory_id":"39f819ce-205d-4c7f-aef4-8191a740264f","event_types":["advisory"],"published_at":"2026-10-25T22:49:38.063236+00:00","technologies":["core-osv","request-9047-keycloak-fips-26-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:31+00:00","detail_url":"/events/71452"}]}},{"id":71077,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3hp3-mg5v-x42c","summary":"CGA-3hp3-mg5v-x42c","evidence":"osv:CGA-3hp3-mg5v-x42c","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3hp3-mg5v-x42c","aliases":["CGA-3hp3-mg5v-x42c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hp3-mg5v-x42c.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:11Z"}]}}],"modified":"2026-10-02T23:00:13.537613803Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hp3-mg5v-x42c","advisory_id":"99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","event_types":["advisory"],"published_at":"2026-10-25T22:49:34.609794+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:31+00:00","detail_url":"/advisories/advisory%3A99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","group":{"id":"advisory:99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","revision":1,"primary_event_id":71451,"change":"published","superseded_by":[],"changed":{"id":71451,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3hp3-mg5v-x42c","summary":"CGA-3hp3-mg5v-x42c","evidence":"osv:CGA-3hp3-mg5v-x42c","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3hp3-mg5v-x42c","aliases":["CGA-3hp3-mg5v-x42c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hp3-mg5v-x42c.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:11Z"}]}}],"modified":"2026-10-02T23:00:13.537613803Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hp3-mg5v-x42c","advisory_id":"99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","event_types":["advisory"],"published_at":"2026-10-25T22:49:34.609794+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:31+00:00","detail_url":"/events/71451"},"members":[{"id":71451,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3hp3-mg5v-x42c","summary":"CGA-3hp3-mg5v-x42c","evidence":"osv:CGA-3hp3-mg5v-x42c","products":[{"name":{"value":"elasticsearch-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3hp3-mg5v-x42c","aliases":["CGA-3hp3-mg5v-x42c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r12"}]}],"package":{"name":"elasticsearch-9.3","purl":"pkg:apk/chainguard/elasticsearch-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hp3-mg5v-x42c.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/tools/plugin-cli/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:59:11Z"}]}}],"modified":"2026-10-02T23:00:13.537613803Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hp3-mg5v-x42c","advisory_id":"99bd0b9e-ac33-4ea3-ae9c-a1024e9f6cd6","event_types":["advisory"],"published_at":"2026-10-25T22:49:34.609794+00:00","technologies":["core-osv","elasticsearch-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:41:31+00:00","detail_url":"/events/71451"}]}},{"id":71076,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2v48-wm78-6qgg","summary":"CGA-2v48-wm78-6qgg","evidence":"osv:CGA-2v48-wm78-6qgg","products":[{"name":{"value":"cassandra-reaper","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"cassandra-reaper","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v48-wm78-6qgg","aliases":["CGA-2v48-wm78-6qgg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/chainguard/cassandra-reaper?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v48-wm78-6qgg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:49:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/wolfi/cassandra-reaper?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v48-wm78-6qgg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:49:08Z"}]}}],"modified":"2026-10-02T23:00:13.486465415Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c22ce13f-a5fc-48f4-8795-a3b2afda74cf","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v48-wm78-6qgg","advisory_id":"c22ce13f-a5fc-48f4-8795-a3b2afda74cf","event_types":["advisory"],"published_at":"2026-10-25T22:49:31.158416+00:00","technologies":["cassandra-reaper","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:16:39+00:00","detail_url":"/advisories/advisory%3Ac22ce13f-a5fc-48f4-8795-a3b2afda74cf","group":{"id":"advisory:c22ce13f-a5fc-48f4-8795-a3b2afda74cf","revision":1,"primary_event_id":71450,"change":"published","superseded_by":[],"changed":{"id":71450,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2v48-wm78-6qgg","summary":"CGA-2v48-wm78-6qgg","evidence":"osv:CGA-2v48-wm78-6qgg","products":[{"name":{"value":"cassandra-reaper","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"cassandra-reaper","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v48-wm78-6qgg","aliases":["CGA-2v48-wm78-6qgg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/chainguard/cassandra-reaper?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v48-wm78-6qgg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:49:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/wolfi/cassandra-reaper?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v48-wm78-6qgg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:49:08Z"}]}}],"modified":"2026-10-02T23:00:13.486465415Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c22ce13f-a5fc-48f4-8795-a3b2afda74cf","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v48-wm78-6qgg","advisory_id":"c22ce13f-a5fc-48f4-8795-a3b2afda74cf","event_types":["advisory"],"published_at":"2026-10-25T22:49:31.158416+00:00","technologies":["cassandra-reaper","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:16:39+00:00","detail_url":"/events/71450"},"members":[{"id":71450,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2v48-wm78-6qgg","summary":"CGA-2v48-wm78-6qgg","evidence":"osv:CGA-2v48-wm78-6qgg","products":[{"name":{"value":"cassandra-reaper","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"cassandra-reaper","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v48-wm78-6qgg","aliases":["CGA-2v48-wm78-6qgg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/chainguard/cassandra-reaper?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v48-wm78-6qgg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:49:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/wolfi/cassandra-reaper?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v48-wm78-6qgg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:49:08Z"}]}}],"modified":"2026-10-02T23:00:13.486465415Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c22ce13f-a5fc-48f4-8795-a3b2afda74cf","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v48-wm78-6qgg","advisory_id":"c22ce13f-a5fc-48f4-8795-a3b2afda74cf","event_types":["advisory"],"published_at":"2026-10-25T22:49:31.158416+00:00","technologies":["cassandra-reaper","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:16:39+00:00","detail_url":"/events/71450"}]}},{"id":71075,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2v2g-8w75-3prr","summary":"CGA-2v2g-8w75-3prr","evidence":"osv:CGA-2v2g-8w75-3prr","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v2g-8w75-3prr","aliases":["CGA-2v2g-8w75-3prr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v2g-8w75-3prr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:51Z"}]}}],"modified":"2026-10-02T23:00:13.436448191Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e919532-4e69-4bc7-8051-20f7b8b70d9d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v2g-8w75-3prr","advisory_id":"3e919532-4e69-4bc7-8051-20f7b8b70d9d","event_types":["advisory"],"published_at":"2026-10-25T22:49:30.554625+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/advisories/advisory%3A3e919532-4e69-4bc7-8051-20f7b8b70d9d","group":{"id":"advisory:3e919532-4e69-4bc7-8051-20f7b8b70d9d","revision":1,"primary_event_id":71449,"change":"published","superseded_by":[],"changed":{"id":71449,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2v2g-8w75-3prr","summary":"CGA-2v2g-8w75-3prr","evidence":"osv:CGA-2v2g-8w75-3prr","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v2g-8w75-3prr","aliases":["CGA-2v2g-8w75-3prr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v2g-8w75-3prr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:51Z"}]}}],"modified":"2026-10-02T23:00:13.436448191Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e919532-4e69-4bc7-8051-20f7b8b70d9d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v2g-8w75-3prr","advisory_id":"3e919532-4e69-4bc7-8051-20f7b8b70d9d","event_types":["advisory"],"published_at":"2026-10-25T22:49:30.554625+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/events/71449"},"members":[{"id":71449,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2v2g-8w75-3prr","summary":"CGA-2v2g-8w75-3prr","evidence":"osv:CGA-2v2g-8w75-3prr","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v2g-8w75-3prr","aliases":["CGA-2v2g-8w75-3prr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v2g-8w75-3prr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:51Z"}]}}],"modified":"2026-10-02T23:00:13.436448191Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e919532-4e69-4bc7-8051-20f7b8b70d9d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v2g-8w75-3prr","advisory_id":"3e919532-4e69-4bc7-8051-20f7b8b70d9d","event_types":["advisory"],"published_at":"2026-10-25T22:49:30.554625+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:03:39+00:00","detail_url":"/events/71449"}]}},{"id":71074,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-2v7h-mrhq-8rfp","summary":"CGA-2v7h-mrhq-8rfp","evidence":"osv:CGA-2v7h-mrhq-8rfp","products":[{"name":{"value":"elasticsearch-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v7h-mrhq-8rfp","aliases":["CGA-2v7h-mrhq-8rfp"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-8.19","purl":"pkg:apk/chainguard/elasticsearch-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v7h-mrhq-8rfp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:02:08Z"}]}}],"modified":"2026-10-02T23:00:13.232865715Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6e01541b-6bb7-4bda-8908-84b88ffde244","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v7h-mrhq-8rfp","advisory_id":"6e01541b-6bb7-4bda-8908-84b88ffde244","event_types":["advisory"],"published_at":"2026-10-25T22:49:27.334237+00:00","technologies":["core-osv","elasticsearch-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:43:43+00:00","detail_url":"/advisories/advisory%3A6e01541b-6bb7-4bda-8908-84b88ffde244","group":{"id":"advisory:6e01541b-6bb7-4bda-8908-84b88ffde244","revision":1,"primary_event_id":71448,"change":"published","superseded_by":[],"changed":{"id":71448,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-2v7h-mrhq-8rfp","summary":"CGA-2v7h-mrhq-8rfp","evidence":"osv:CGA-2v7h-mrhq-8rfp","products":[{"name":{"value":"elasticsearch-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v7h-mrhq-8rfp","aliases":["CGA-2v7h-mrhq-8rfp"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-8.19","purl":"pkg:apk/chainguard/elasticsearch-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v7h-mrhq-8rfp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:02:08Z"}]}}],"modified":"2026-10-02T23:00:13.232865715Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6e01541b-6bb7-4bda-8908-84b88ffde244","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v7h-mrhq-8rfp","advisory_id":"6e01541b-6bb7-4bda-8908-84b88ffde244","event_types":["advisory"],"published_at":"2026-10-25T22:49:27.334237+00:00","technologies":["core-osv","elasticsearch-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:43:43+00:00","detail_url":"/events/71448"},"members":[{"id":71448,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-2v7h-mrhq-8rfp","summary":"CGA-2v7h-mrhq-8rfp","evidence":"osv:CGA-2v7h-mrhq-8rfp","products":[{"name":{"value":"elasticsearch-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2v7h-mrhq-8rfp","aliases":["CGA-2v7h-mrhq-8rfp"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-8.19","purl":"pkg:apk/chainguard/elasticsearch-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2v7h-mrhq-8rfp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/x-pack-sql/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:02:08Z"}]}}],"modified":"2026-10-02T23:00:13.232865715Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6e01541b-6bb7-4bda-8908-84b88ffde244","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2v7h-mrhq-8rfp","advisory_id":"6e01541b-6bb7-4bda-8908-84b88ffde244","event_types":["advisory"],"published_at":"2026-10-25T22:49:27.334237+00:00","technologies":["core-osv","elasticsearch-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:43:43+00:00","detail_url":"/events/71448"}]}},{"id":71073,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3j2g-c27g-w6c8","summary":"CGA-3j2g-c27g-w6c8","evidence":"osv:CGA-3j2g-c27g-w6c8","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3j2g-c27g-w6c8","aliases":["CGA-3j2g-c27g-w6c8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3j2g-c27g-w6c8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:00:12.972473986Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3j2g-c27g-w6c8","advisory_id":"78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","event_types":["advisory"],"published_at":"2026-10-25T22:49:26.919584+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/advisories/advisory%3A78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","group":{"id":"advisory:78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","revision":1,"primary_event_id":71447,"change":"published","superseded_by":[],"changed":{"id":71447,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3j2g-c27g-w6c8","summary":"CGA-3j2g-c27g-w6c8","evidence":"osv:CGA-3j2g-c27g-w6c8","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3j2g-c27g-w6c8","aliases":["CGA-3j2g-c27g-w6c8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3j2g-c27g-w6c8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:00:12.972473986Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3j2g-c27g-w6c8","advisory_id":"78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","event_types":["advisory"],"published_at":"2026-10-25T22:49:26.919584+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/events/71447"},"members":[{"id":71447,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3j2g-c27g-w6c8","summary":"CGA-3j2g-c27g-w6c8","evidence":"osv:CGA-3j2g-c27g-w6c8","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3j2g-c27g-w6c8","aliases":["CGA-3j2g-c27g-w6c8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3j2g-c27g-w6c8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/repository-gcs/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:42Z"}]}}],"modified":"2026-10-02T23:00:12.972473986Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3j2g-c27g-w6c8","advisory_id":"78bdcff2-9b52-4038-ab5d-7ce5099cf4c5","event_types":["advisory"],"published_at":"2026-10-25T22:49:26.919584+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:41+00:00","detail_url":"/events/71447"}]}},{"id":71072,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3fqw-j88r-6588","summary":"CGA-3fqw-j88r-6588","evidence":"osv:CGA-3fqw-j88r-6588","products":[{"name":{"value":"elasticsearch-fips-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3fqw-j88r-6588","aliases":["CGA-3fqw-j88r-6588"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r5"}]}],"package":{"name":"elasticsearch-fips-9.3","purl":"pkg:apk/chainguard/elasticsearch-fips-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3fqw-j88r-6588.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:12:11Z"}]}}],"modified":"2026-10-02T23:00:12.973588946Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7dd14503-438b-47f3-83f2-8c2a360dbb1b","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3fqw-j88r-6588","advisory_id":"7dd14503-438b-47f3-83f2-8c2a360dbb1b","event_types":["advisory"],"published_at":"2026-10-25T22:49:24.50715+00:00","technologies":["core-osv","elasticsearch-fips-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:03:34+00:00","detail_url":"/advisories/advisory%3A7dd14503-438b-47f3-83f2-8c2a360dbb1b","group":{"id":"advisory:7dd14503-438b-47f3-83f2-8c2a360dbb1b","revision":1,"primary_event_id":71446,"change":"published","superseded_by":[],"changed":{"id":71446,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3fqw-j88r-6588","summary":"CGA-3fqw-j88r-6588","evidence":"osv:CGA-3fqw-j88r-6588","products":[{"name":{"value":"elasticsearch-fips-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3fqw-j88r-6588","aliases":["CGA-3fqw-j88r-6588"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r5"}]}],"package":{"name":"elasticsearch-fips-9.3","purl":"pkg:apk/chainguard/elasticsearch-fips-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3fqw-j88r-6588.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:12:11Z"}]}}],"modified":"2026-10-02T23:00:12.973588946Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7dd14503-438b-47f3-83f2-8c2a360dbb1b","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3fqw-j88r-6588","advisory_id":"7dd14503-438b-47f3-83f2-8c2a360dbb1b","event_types":["advisory"],"published_at":"2026-10-25T22:49:24.50715+00:00","technologies":["core-osv","elasticsearch-fips-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:03:34+00:00","detail_url":"/events/71446"},"members":[{"id":71446,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3fqw-j88r-6588","summary":"CGA-3fqw-j88r-6588","evidence":"osv:CGA-3fqw-j88r-6588","products":[{"name":{"value":"elasticsearch-fips-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.8-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3fqw-j88r-6588","aliases":["CGA-3fqw-j88r-6588"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.8-r5"}]}],"package":{"name":"elasticsearch-fips-9.3","purl":"pkg:apk/chainguard/elasticsearch-fips-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3fqw-j88r-6588.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.8","component_type":"java-archive","component_version":"2.18.8","component_location":"/usr/share/elasticsearch/lib/elasticsearch-x-content-9.3.8.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:12:11Z"}]}}],"modified":"2026-10-02T23:00:12.973588946Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7dd14503-438b-47f3-83f2-8c2a360dbb1b","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3fqw-j88r-6588","advisory_id":"7dd14503-438b-47f3-83f2-8c2a360dbb1b","event_types":["advisory"],"published_at":"2026-10-25T22:49:24.50715+00:00","technologies":["core-osv","elasticsearch-fips-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:03:34+00:00","detail_url":"/events/71446"}]}},{"id":71071,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3gv5-c3vm-m5m5","summary":"CGA-3gv5-c3vm-m5m5","evidence":"osv:CGA-3gv5-c3vm-m5m5","products":[{"name":{"value":"elasticsearch-9.2-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3gv5-c3vm-m5m5","aliases":["CGA-3gv5-c3vm-m5m5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r18"}]}],"package":{"name":"elasticsearch-9.2-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-9.2-iamguarded-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gv5-c3vm-m5m5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/opt/iamguarded/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:54:02Z"}]}}],"modified":"2026-10-02T23:00:12.972300208Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3b17eb08-afb6-47c8-b4b6-6501e13f3c5d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gv5-c3vm-m5m5","advisory_id":"3b17eb08-afb6-47c8-b4b6-6501e13f3c5d","event_types":["advisory"],"published_at":"2026-10-25T22:49:23.970708+00:00","technologies":["core-osv","elasticsearch-9-2-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:45+00:00","detail_url":"/advisories/advisory%3A3b17eb08-afb6-47c8-b4b6-6501e13f3c5d","group":{"id":"advisory:3b17eb08-afb6-47c8-b4b6-6501e13f3c5d","revision":1,"primary_event_id":71445,"change":"published","superseded_by":[],"changed":{"id":71445,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3gv5-c3vm-m5m5","summary":"CGA-3gv5-c3vm-m5m5","evidence":"osv:CGA-3gv5-c3vm-m5m5","products":[{"name":{"value":"elasticsearch-9.2-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3gv5-c3vm-m5m5","aliases":["CGA-3gv5-c3vm-m5m5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r18"}]}],"package":{"name":"elasticsearch-9.2-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-9.2-iamguarded-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gv5-c3vm-m5m5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/opt/iamguarded/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:54:02Z"}]}}],"modified":"2026-10-02T23:00:12.972300208Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3b17eb08-afb6-47c8-b4b6-6501e13f3c5d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gv5-c3vm-m5m5","advisory_id":"3b17eb08-afb6-47c8-b4b6-6501e13f3c5d","event_types":["advisory"],"published_at":"2026-10-25T22:49:23.970708+00:00","technologies":["core-osv","elasticsearch-9-2-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:45+00:00","detail_url":"/events/71445"},"members":[{"id":71445,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3gv5-c3vm-m5m5","summary":"CGA-3gv5-c3vm-m5m5","evidence":"osv:CGA-3gv5-c3vm-m5m5","products":[{"name":{"value":"elasticsearch-9.2-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3gv5-c3vm-m5m5","aliases":["CGA-3gv5-c3vm-m5m5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r18"}]}],"package":{"name":"elasticsearch-9.2-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-9.2-iamguarded-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gv5-c3vm-m5m5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/opt/iamguarded/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:54:02Z"}]}}],"modified":"2026-10-02T23:00:12.972300208Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3b17eb08-afb6-47c8-b4b6-6501e13f3c5d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gv5-c3vm-m5m5","advisory_id":"3b17eb08-afb6-47c8-b4b6-6501e13f3c5d","event_types":["advisory"],"published_at":"2026-10-25T22:49:23.970708+00:00","technologies":["core-osv","elasticsearch-9-2-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:45+00:00","detail_url":"/events/71445"}]}},{"id":71070,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3f77-9x5g-8pjp","summary":"CGA-3f77-9x5g-8pjp","evidence":"osv:CGA-3f77-9x5g-8pjp","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3f77-9x5g-8pjp","aliases":["CGA-3f77-9x5g-8pjp"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3f77-9x5g-8pjp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/repository-azure/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:11:19Z"}]}}],"modified":"2026-10-02T23:00:12.970185306Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f4b21884-c92b-41a5-8f27-ac3c2cac4ebc","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3f77-9x5g-8pjp","advisory_id":"f4b21884-c92b-41a5-8f27-ac3c2cac4ebc","event_types":["advisory"],"published_at":"2026-10-25T22:49:21.680311+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:02+00:00","detail_url":"/advisories/advisory%3Af4b21884-c92b-41a5-8f27-ac3c2cac4ebc","group":{"id":"advisory:f4b21884-c92b-41a5-8f27-ac3c2cac4ebc","revision":1,"primary_event_id":71444,"change":"published","superseded_by":[],"changed":{"id":71444,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3f77-9x5g-8pjp","summary":"CGA-3f77-9x5g-8pjp","evidence":"osv:CGA-3f77-9x5g-8pjp","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3f77-9x5g-8pjp","aliases":["CGA-3f77-9x5g-8pjp"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3f77-9x5g-8pjp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/repository-azure/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:11:19Z"}]}}],"modified":"2026-10-02T23:00:12.970185306Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f4b21884-c92b-41a5-8f27-ac3c2cac4ebc","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3f77-9x5g-8pjp","advisory_id":"f4b21884-c92b-41a5-8f27-ac3c2cac4ebc","event_types":["advisory"],"published_at":"2026-10-25T22:49:21.680311+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:02+00:00","detail_url":"/events/71444"},"members":[{"id":71444,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-3f77-9x5g-8pjp","summary":"CGA-3f77-9x5g-8pjp","evidence":"osv:CGA-3f77-9x5g-8pjp","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3f77-9x5g-8pjp","aliases":["CGA-3f77-9x5g-8pjp"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3f77-9x5g-8pjp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/repository-azure/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:11:19Z"}]}}],"modified":"2026-10-02T23:00:12.970185306Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f4b21884-c92b-41a5-8f27-ac3c2cac4ebc","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3f77-9x5g-8pjp","advisory_id":"f4b21884-c92b-41a5-8f27-ac3c2cac4ebc","event_types":["advisory"],"published_at":"2026-10-25T22:49:21.680311+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:02+00:00","detail_url":"/events/71444"}]}},{"id":71069,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3gch-vv65-r6m2","summary":"CGA-3gch-vv65-r6m2","evidence":"osv:CGA-3gch-vv65-r6m2","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3gch-vv65-r6m2","aliases":["CGA-3gch-vv65-r6m2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gch-vv65-r6m2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/x-pack-esql/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:11:19Z"}]}}],"modified":"2026-10-02T23:00:12.961704131Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5ac61c69-60f8-4ce1-bc25-775589902140","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gch-vv65-r6m2","advisory_id":"5ac61c69-60f8-4ce1-bc25-775589902140","event_types":["advisory"],"published_at":"2026-10-25T22:49:19.598234+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:02+00:00","detail_url":"/advisories/advisory%3A5ac61c69-60f8-4ce1-bc25-775589902140","group":{"id":"advisory:5ac61c69-60f8-4ce1-bc25-775589902140","revision":1,"primary_event_id":71443,"change":"published","superseded_by":[],"changed":{"id":71443,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3gch-vv65-r6m2","summary":"CGA-3gch-vv65-r6m2","evidence":"osv:CGA-3gch-vv65-r6m2","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3gch-vv65-r6m2","aliases":["CGA-3gch-vv65-r6m2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gch-vv65-r6m2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/x-pack-esql/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:11:19Z"}]}}],"modified":"2026-10-02T23:00:12.961704131Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5ac61c69-60f8-4ce1-bc25-775589902140","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gch-vv65-r6m2","advisory_id":"5ac61c69-60f8-4ce1-bc25-775589902140","event_types":["advisory"],"published_at":"2026-10-25T22:49:19.598234+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:02+00:00","detail_url":"/events/71443"},"members":[{"id":71443,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-3gch-vv65-r6m2","summary":"CGA-3gch-vv65-r6m2","evidence":"osv:CGA-3gch-vv65-r6m2","products":[{"name":{"value":"elasticsearch-fips-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3gch-vv65-r6m2","aliases":["CGA-3gch-vv65-r6m2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r3"}]}],"package":{"name":"elasticsearch-fips-8.19","purl":"pkg:apk/chainguard/elasticsearch-fips-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gch-vv65-r6m2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/elasticsearch/modules/x-pack-esql/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:11:19Z"}]}}],"modified":"2026-10-02T23:00:12.961704131Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5ac61c69-60f8-4ce1-bc25-775589902140","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gch-vv65-r6m2","advisory_id":"5ac61c69-60f8-4ce1-bc25-775589902140","event_types":["advisory"],"published_at":"2026-10-25T22:49:19.598234+00:00","technologies":["core-osv","elasticsearch-fips-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:39:02+00:00","detail_url":"/events/71443"}]}},{"id":71068,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-3gp8-j828-jhj3","summary":"CGA-3gp8-j828-jhj3","evidence":"osv:CGA-3gp8-j828-jhj3","products":[{"name":{"value":"airbyte-platform-fips-workload-launcher","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.0-r10","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3gp8-j828-jhj3","aliases":["CGA-3gp8-j828-jhj3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-r10"}]}],"package":{"name":"airbyte-platform-fips-workload-launcher","purl":"pkg:apk/chainguard/airbyte-platform-fips-workload-launcher?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gp8-j828-jhj3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/airbyte-platform-fips-workload-launcher/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:03:56Z"}]}}],"modified":"2026-10-02T23:00:12.960569297Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:40d6274a-78f7-4a5b-8316-45bff6ad1550","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gp8-j828-jhj3","advisory_id":"40d6274a-78f7-4a5b-8316-45bff6ad1550","event_types":["advisory"],"published_at":"2026-10-25T22:49:16.111887+00:00","technologies":["airbyte-platform-fips-workload-launcher","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:28:38+00:00","detail_url":"/advisories/advisory%3A40d6274a-78f7-4a5b-8316-45bff6ad1550","group":{"id":"advisory:40d6274a-78f7-4a5b-8316-45bff6ad1550","revision":1,"primary_event_id":71442,"change":"published","superseded_by":[],"changed":{"id":71442,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-3gp8-j828-jhj3","summary":"CGA-3gp8-j828-jhj3","evidence":"osv:CGA-3gp8-j828-jhj3","products":[{"name":{"value":"airbyte-platform-fips-workload-launcher","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.0-r10","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3gp8-j828-jhj3","aliases":["CGA-3gp8-j828-jhj3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-r10"}]}],"package":{"name":"airbyte-platform-fips-workload-launcher","purl":"pkg:apk/chainguard/airbyte-platform-fips-workload-launcher?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gp8-j828-jhj3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/airbyte-platform-fips-workload-launcher/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:03:56Z"}]}}],"modified":"2026-10-02T23:00:12.960569297Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:40d6274a-78f7-4a5b-8316-45bff6ad1550","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gp8-j828-jhj3","advisory_id":"40d6274a-78f7-4a5b-8316-45bff6ad1550","event_types":["advisory"],"published_at":"2026-10-25T22:49:16.111887+00:00","technologies":["airbyte-platform-fips-workload-launcher","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:28:38+00:00","detail_url":"/events/71442"},"members":[{"id":71442,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-3gp8-j828-jhj3","summary":"CGA-3gp8-j828-jhj3","evidence":"osv:CGA-3gp8-j828-jhj3","products":[{"name":{"value":"airbyte-platform-fips-workload-launcher","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.0-r10","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3gp8-j828-jhj3","aliases":["CGA-3gp8-j828-jhj3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-r10"}]}],"package":{"name":"airbyte-platform-fips-workload-launcher","purl":"pkg:apk/chainguard/airbyte-platform-fips-workload-launcher?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gp8-j828-jhj3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/airbyte-platform-fips-workload-launcher/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:03:56Z"}]}}],"modified":"2026-10-02T23:00:12.960569297Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:40d6274a-78f7-4a5b-8316-45bff6ad1550","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gp8-j828-jhj3","advisory_id":"40d6274a-78f7-4a5b-8316-45bff6ad1550","event_types":["advisory"],"published_at":"2026-10-25T22:49:16.111887+00:00","technologies":["airbyte-platform-fips-workload-launcher","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:28:38+00:00","detail_url":"/events/71442"}]}},{"id":71067,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-3hhv-qc6c-46jj","summary":"CGA-3hhv-qc6c-46jj","evidence":"osv:CGA-3hhv-qc6c-46jj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3hhv-qc6c-46jj","aliases":["CGA-3hhv-qc6c-46jj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hhv-qc6c-46jj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:00:12.955277168Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hhv-qc6c-46jj","advisory_id":"c3c3c9a2-769c-445c-a429-6c90b93be634","event_types":["advisory"],"published_at":"2026-10-25T22:49:14.925024+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/advisories/advisory%3Ac3c3c9a2-769c-445c-a429-6c90b93be634","group":{"id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","revision":1,"primary_event_id":71441,"change":"published","superseded_by":[],"changed":{"id":71441,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-3hhv-qc6c-46jj","summary":"CGA-3hhv-qc6c-46jj","evidence":"osv:CGA-3hhv-qc6c-46jj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3hhv-qc6c-46jj","aliases":["CGA-3hhv-qc6c-46jj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hhv-qc6c-46jj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:00:12.955277168Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hhv-qc6c-46jj","advisory_id":"c3c3c9a2-769c-445c-a429-6c90b93be634","event_types":["advisory"],"published_at":"2026-10-25T22:49:14.925024+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/events/71441"},"members":[{"id":71441,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-3hhv-qc6c-46jj","summary":"CGA-3hhv-qc6c-46jj","evidence":"osv:CGA-3hhv-qc6c-46jj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3hhv-qc6c-46jj","aliases":["CGA-3hhv-qc6c-46jj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hhv-qc6c-46jj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:00:12.955277168Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hhv-qc6c-46jj","advisory_id":"c3c3c9a2-769c-445c-a429-6c90b93be634","event_types":["advisory"],"published_at":"2026-10-25T22:49:14.925024+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/events/71441"}]}},{"id":71066,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-3gh2-4qq6-6vj3","summary":"CGA-3gh2-4qq6-6vj3","evidence":"osv:CGA-3gh2-4qq6-6vj3","products":[{"name":{"value":"logstash-fips-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3gh2-4qq6-6vj3","aliases":["CGA-3gh2-4qq6-6vj3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-fips-9.5","purl":"pkg:apk/chainguard/logstash-fips-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gh2-4qq6-6vj3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:52Z"}]}}],"modified":"2026-10-02T23:00:12.952853409Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a8d0abca-64aa-4533-864b-d51e3d617222","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gh2-4qq6-6vj3","advisory_id":"a8d0abca-64aa-4533-864b-d51e3d617222","event_types":["advisory"],"published_at":"2026-10-25T22:49:09.423985+00:00","technologies":["core-osv","logstash-fips-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:36:35+00:00","detail_url":"/advisories/advisory%3Aa8d0abca-64aa-4533-864b-d51e3d617222","group":{"id":"advisory:a8d0abca-64aa-4533-864b-d51e3d617222","revision":1,"primary_event_id":71440,"change":"published","superseded_by":[],"changed":{"id":71440,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-3gh2-4qq6-6vj3","summary":"CGA-3gh2-4qq6-6vj3","evidence":"osv:CGA-3gh2-4qq6-6vj3","products":[{"name":{"value":"logstash-fips-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3gh2-4qq6-6vj3","aliases":["CGA-3gh2-4qq6-6vj3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-fips-9.5","purl":"pkg:apk/chainguard/logstash-fips-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gh2-4qq6-6vj3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:52Z"}]}}],"modified":"2026-10-02T23:00:12.952853409Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a8d0abca-64aa-4533-864b-d51e3d617222","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gh2-4qq6-6vj3","advisory_id":"a8d0abca-64aa-4533-864b-d51e3d617222","event_types":["advisory"],"published_at":"2026-10-25T22:49:09.423985+00:00","technologies":["core-osv","logstash-fips-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:36:35+00:00","detail_url":"/events/71440"},"members":[{"id":71440,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-3gh2-4qq6-6vj3","summary":"CGA-3gh2-4qq6-6vj3","evidence":"osv:CGA-3gh2-4qq6-6vj3","products":[{"name":{"value":"logstash-fips-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3gh2-4qq6-6vj3","aliases":["CGA-3gh2-4qq6-6vj3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-fips-9.5","purl":"pkg:apk/chainguard/logstash-fips-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3gh2-4qq6-6vj3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-filter-elastic_integration-9.4.6-java/vendor/jar-dependencies/co/elastic/logstash-filter-elastic_integration/9.4.6/logstash-filter-elastic_integration-9.4.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:42:52Z"}]}}],"modified":"2026-10-02T23:00:12.952853409Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a8d0abca-64aa-4533-864b-d51e3d617222","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3gh2-4qq6-6vj3","advisory_id":"a8d0abca-64aa-4533-864b-d51e3d617222","event_types":["advisory"],"published_at":"2026-10-25T22:49:09.423985+00:00","technologies":["core-osv","logstash-fips-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:36:35+00:00","detail_url":"/events/71440"}]}},{"id":71065,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-x5p7-4pmh-647q","summary":"CGA-x5p7-4pmh-647q","evidence":"osv:CGA-x5p7-4pmh-647q","products":[{"name":{"value":"strimzi-kafka-operator-fips-kafka-thirdparty-libs","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.2.0-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x5p7-4pmh-647q","aliases":["CGA-x5p7-4pmh-647q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r6"}]}],"package":{"name":"strimzi-kafka-operator-fips-kafka-thirdparty-libs","purl":"pkg:apk/chainguard/strimzi-kafka-operator-fips-kafka-thirdparty-libs?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x5p7-4pmh-647q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/lib/kafka/libs/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:53:07Z"}]}}],"modified":"2026-10-02T23:00:12.068797393Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:734e5841-58c4-4ea7-81eb-929c4c21d77e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x5p7-4pmh-647q","advisory_id":"734e5841-58c4-4ea7-81eb-929c4c21d77e","event_types":["advisory"],"published_at":"2026-10-25T22:49:04.092047+00:00","technologies":["core-osv","strimzi-kafka-operator-fips-kafka-thirdparty-libs"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:30:56+00:00","detail_url":"/advisories/advisory%3A734e5841-58c4-4ea7-81eb-929c4c21d77e","group":{"id":"advisory:734e5841-58c4-4ea7-81eb-929c4c21d77e","revision":1,"primary_event_id":71439,"change":"published","superseded_by":[],"changed":{"id":71439,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-x5p7-4pmh-647q","summary":"CGA-x5p7-4pmh-647q","evidence":"osv:CGA-x5p7-4pmh-647q","products":[{"name":{"value":"strimzi-kafka-operator-fips-kafka-thirdparty-libs","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.2.0-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x5p7-4pmh-647q","aliases":["CGA-x5p7-4pmh-647q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r6"}]}],"package":{"name":"strimzi-kafka-operator-fips-kafka-thirdparty-libs","purl":"pkg:apk/chainguard/strimzi-kafka-operator-fips-kafka-thirdparty-libs?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x5p7-4pmh-647q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/lib/kafka/libs/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:53:07Z"}]}}],"modified":"2026-10-02T23:00:12.068797393Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:734e5841-58c4-4ea7-81eb-929c4c21d77e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x5p7-4pmh-647q","advisory_id":"734e5841-58c4-4ea7-81eb-929c4c21d77e","event_types":["advisory"],"published_at":"2026-10-25T22:49:04.092047+00:00","technologies":["core-osv","strimzi-kafka-operator-fips-kafka-thirdparty-libs"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:30:56+00:00","detail_url":"/events/71439"},"members":[{"id":71439,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-x5p7-4pmh-647q","summary":"CGA-x5p7-4pmh-647q","evidence":"osv:CGA-x5p7-4pmh-647q","products":[{"name":{"value":"strimzi-kafka-operator-fips-kafka-thirdparty-libs","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.2.0-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x5p7-4pmh-647q","aliases":["CGA-x5p7-4pmh-647q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r6"}]}],"package":{"name":"strimzi-kafka-operator-fips-kafka-thirdparty-libs","purl":"pkg:apk/chainguard/strimzi-kafka-operator-fips-kafka-thirdparty-libs?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x5p7-4pmh-647q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.1","component_type":"java-archive","component_version":"2.22.1","component_location":"/usr/lib/kafka/libs/jackson-databind-2.22.2.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:53:07Z"}]}}],"modified":"2026-10-02T23:00:12.068797393Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:734e5841-58c4-4ea7-81eb-929c4c21d77e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x5p7-4pmh-647q","advisory_id":"734e5841-58c4-4ea7-81eb-929c4c21d77e","event_types":["advisory"],"published_at":"2026-10-25T22:49:04.092047+00:00","technologies":["core-osv","strimzi-kafka-operator-fips-kafka-thirdparty-libs"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:30:56+00:00","detail_url":"/events/71439"}]}},{"id":71064,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-w6q5-c9m4-6q56","summary":"CGA-w6q5-c9m4-6q56","evidence":"osv:CGA-w6q5-c9m4-6q56","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w6q5-c9m4-6q56","aliases":["CGA-w6q5-c9m4-6q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q5-c9m4-6q56.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.658924629Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q5-c9m4-6q56","advisory_id":"1138c2e6-508d-4299-8d9f-1b74249e6394","event_types":["advisory"],"published_at":"2026-10-25T22:49:03.318767+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/advisories/advisory%3A1138c2e6-508d-4299-8d9f-1b74249e6394","group":{"id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","revision":1,"primary_event_id":71438,"change":"published","superseded_by":[],"changed":{"id":71438,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-w6q5-c9m4-6q56","summary":"CGA-w6q5-c9m4-6q56","evidence":"osv:CGA-w6q5-c9m4-6q56","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w6q5-c9m4-6q56","aliases":["CGA-w6q5-c9m4-6q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q5-c9m4-6q56.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.658924629Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q5-c9m4-6q56","advisory_id":"1138c2e6-508d-4299-8d9f-1b74249e6394","event_types":["advisory"],"published_at":"2026-10-25T22:49:03.318767+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/events/71438"},"members":[{"id":71438,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-w6q5-c9m4-6q56","summary":"CGA-w6q5-c9m4-6q56","evidence":"osv:CGA-w6q5-c9m4-6q56","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w6q5-c9m4-6q56","aliases":["CGA-w6q5-c9m4-6q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q5-c9m4-6q56.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.658924629Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q5-c9m4-6q56","advisory_id":"1138c2e6-508d-4299-8d9f-1b74249e6394","event_types":["advisory"],"published_at":"2026-10-25T22:49:03.318767+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/events/71438"}]}},{"id":71063,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-w2cq-hvr3-hgq5","summary":"CGA-w2cq-hvr3-hgq5","evidence":"osv:CGA-w2cq-hvr3-hgq5","products":[{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w2cq-hvr3-hgq5","aliases":["CGA-w2cq-hvr3-hgq5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w2cq-hvr3-hgq5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:19Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w2cq-hvr3-hgq5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:19Z"}]}}],"modified":"2026-10-02T23:00:11.632670434Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c2ce1b01-1b32-4bed-90f3-4fcb733bfffe","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w2cq-hvr3-hgq5","advisory_id":"c2ce1b01-1b32-4bed-90f3-4fcb733bfffe","event_types":["advisory"],"published_at":"2026-10-25T22:49:02.137604+00:00","technologies":["core-osv","management-api-for-apache-cassandra-5-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:58:54+00:00","detail_url":"/advisories/advisory%3Ac2ce1b01-1b32-4bed-90f3-4fcb733bfffe","group":{"id":"advisory:c2ce1b01-1b32-4bed-90f3-4fcb733bfffe","revision":1,"primary_event_id":71437,"change":"published","superseded_by":[],"changed":{"id":71437,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-w2cq-hvr3-hgq5","summary":"CGA-w2cq-hvr3-hgq5","evidence":"osv:CGA-w2cq-hvr3-hgq5","products":[{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w2cq-hvr3-hgq5","aliases":["CGA-w2cq-hvr3-hgq5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w2cq-hvr3-hgq5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:19Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w2cq-hvr3-hgq5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:19Z"}]}}],"modified":"2026-10-02T23:00:11.632670434Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c2ce1b01-1b32-4bed-90f3-4fcb733bfffe","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w2cq-hvr3-hgq5","advisory_id":"c2ce1b01-1b32-4bed-90f3-4fcb733bfffe","event_types":["advisory"],"published_at":"2026-10-25T22:49:02.137604+00:00","technologies":["core-osv","management-api-for-apache-cassandra-5-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:58:54+00:00","detail_url":"/events/71437"},"members":[{"id":71437,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-w2cq-hvr3-hgq5","summary":"CGA-w2cq-hvr3-hgq5","evidence":"osv:CGA-w2cq-hvr3-hgq5","products":[{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w2cq-hvr3-hgq5","aliases":["CGA-w2cq-hvr3-hgq5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w2cq-hvr3-hgq5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:19Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w2cq-hvr3-hgq5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:19Z"}]}}],"modified":"2026-10-02T23:00:11.632670434Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c2ce1b01-1b32-4bed-90f3-4fcb733bfffe","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w2cq-hvr3-hgq5","advisory_id":"c2ce1b01-1b32-4bed-90f3-4fcb733bfffe","event_types":["advisory"],"published_at":"2026-10-25T22:49:02.137604+00:00","technologies":["core-osv","management-api-for-apache-cassandra-5-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:58:54+00:00","detail_url":"/events/71437"}]}},{"id":71062,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-w45v-54qx-gxcc","summary":"CGA-w45v-54qx-gxcc","evidence":"osv:CGA-w45v-54qx-gxcc","products":[{"name":{"value":"cassandra-reaper","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"cassandra-reaper","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w45v-54qx-gxcc","aliases":["CGA-w45v-54qx-gxcc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/chainguard/cassandra-reaper?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w45v-54qx-gxcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:08:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/wolfi/cassandra-reaper?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w45v-54qx-gxcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:08:07Z"}]}}],"modified":"2026-10-02T23:00:11.620030890Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c8094e42-a1ab-4309-93ac-e26ffb7a520e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w45v-54qx-gxcc","advisory_id":"c8094e42-a1ab-4309-93ac-e26ffb7a520e","event_types":["advisory"],"published_at":"2026-10-25T22:49:00.682041+00:00","technologies":["cassandra-reaper","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:55:49+00:00","detail_url":"/advisories/advisory%3Ac8094e42-a1ab-4309-93ac-e26ffb7a520e","group":{"id":"advisory:c8094e42-a1ab-4309-93ac-e26ffb7a520e","revision":1,"primary_event_id":71436,"change":"published","superseded_by":[],"changed":{"id":71436,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-w45v-54qx-gxcc","summary":"CGA-w45v-54qx-gxcc","evidence":"osv:CGA-w45v-54qx-gxcc","products":[{"name":{"value":"cassandra-reaper","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"cassandra-reaper","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w45v-54qx-gxcc","aliases":["CGA-w45v-54qx-gxcc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/chainguard/cassandra-reaper?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w45v-54qx-gxcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:08:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/wolfi/cassandra-reaper?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w45v-54qx-gxcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:08:07Z"}]}}],"modified":"2026-10-02T23:00:11.620030890Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c8094e42-a1ab-4309-93ac-e26ffb7a520e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w45v-54qx-gxcc","advisory_id":"c8094e42-a1ab-4309-93ac-e26ffb7a520e","event_types":["advisory"],"published_at":"2026-10-25T22:49:00.682041+00:00","technologies":["cassandra-reaper","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:55:49+00:00","detail_url":"/events/71436"},"members":[{"id":71436,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-w45v-54qx-gxcc","summary":"CGA-w45v-54qx-gxcc","evidence":"osv:CGA-w45v-54qx-gxcc","products":[{"name":{"value":"cassandra-reaper","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"cassandra-reaper","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.1-r5","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w45v-54qx-gxcc","aliases":["CGA-w45v-54qx-gxcc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/chainguard/cassandra-reaper?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w45v-54qx-gxcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:08:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-r5"}]}],"package":{"name":"cassandra-reaper","purl":"pkg:apk/wolfi/cassandra-reaper?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w45v-54qx-gxcc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/local/lib/cassandra-reaper.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:08:07Z"}]}}],"modified":"2026-10-02T23:00:11.620030890Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c8094e42-a1ab-4309-93ac-e26ffb7a520e","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w45v-54qx-gxcc","advisory_id":"c8094e42-a1ab-4309-93ac-e26ffb7a520e","event_types":["advisory"],"published_at":"2026-10-25T22:49:00.682041+00:00","technologies":["cassandra-reaper","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T11:55:49+00:00","detail_url":"/events/71436"}]}},{"id":71061,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-vmmv-qrr2-28wc","summary":"CGA-vmmv-qrr2-28wc","evidence":"osv:CGA-vmmv-qrr2-28wc","products":[{"name":{"value":"tigera-operator-fips-1.44","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vmmv-qrr2-28wc","aliases":["CGA-vmmv-qrr2-28wc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"tigera-operator-fips-1.44","purl":"pkg:apk/chainguard/tigera-operator-fips-1.44?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vmmv-qrr2-28wc.json"},"ecosystem_specific":{"components":[{"component_name":"golang.org/x/crypto","component_purl":"pkg:golang/golang.org/x/crypto@v0.57.0","component_type":"go-module","component_version":"v0.57.0","component_location":"/usr/bin/operator","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-10-02T17:55:11Z"}]}}],"modified":"2026-10-02T23:00:11.571024735Z","provider":"osv","upstream":["GO-2026-5932"],"references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:479d1cad-4dff-4734-bb40-866de95b5a61","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vmmv-qrr2-28wc","advisory_id":"479d1cad-4dff-4734-bb40-866de95b5a61","event_types":["advisory"],"published_at":"2026-10-25T22:48:59.879361+00:00","technologies":["core-osv","tigera-operator-fips-1-44"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T17:55:07+00:00","detail_url":"/advisories/advisory%3A479d1cad-4dff-4734-bb40-866de95b5a61","group":{"id":"advisory:479d1cad-4dff-4734-bb40-866de95b5a61","revision":1,"primary_event_id":71435,"change":"published","superseded_by":[],"changed":{"id":71435,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-vmmv-qrr2-28wc","summary":"CGA-vmmv-qrr2-28wc","evidence":"osv:CGA-vmmv-qrr2-28wc","products":[{"name":{"value":"tigera-operator-fips-1.44","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vmmv-qrr2-28wc","aliases":["CGA-vmmv-qrr2-28wc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"tigera-operator-fips-1.44","purl":"pkg:apk/chainguard/tigera-operator-fips-1.44?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vmmv-qrr2-28wc.json"},"ecosystem_specific":{"components":[{"component_name":"golang.org/x/crypto","component_purl":"pkg:golang/golang.org/x/crypto@v0.57.0","component_type":"go-module","component_version":"v0.57.0","component_location":"/usr/bin/operator","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-10-02T17:55:11Z"}]}}],"modified":"2026-10-02T23:00:11.571024735Z","provider":"osv","upstream":["GO-2026-5932"],"references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:479d1cad-4dff-4734-bb40-866de95b5a61","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vmmv-qrr2-28wc","advisory_id":"479d1cad-4dff-4734-bb40-866de95b5a61","event_types":["advisory"],"published_at":"2026-10-25T22:48:59.879361+00:00","technologies":["core-osv","tigera-operator-fips-1-44"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T17:55:07+00:00","detail_url":"/events/71435"},"members":[{"id":71435,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-vmmv-qrr2-28wc","summary":"CGA-vmmv-qrr2-28wc","evidence":"osv:CGA-vmmv-qrr2-28wc","products":[{"name":{"value":"tigera-operator-fips-1.44","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vmmv-qrr2-28wc","aliases":["CGA-vmmv-qrr2-28wc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0"}]}],"package":{"name":"tigera-operator-fips-1.44","purl":"pkg:apk/chainguard/tigera-operator-fips-1.44?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vmmv-qrr2-28wc.json"},"ecosystem_specific":{"components":[{"component_name":"golang.org/x/crypto","component_purl":"pkg:golang/golang.org/x/crypto@v0.57.0","component_type":"go-module","component_version":"v0.57.0","component_location":"/usr/bin/operator","latest_event_status":"false_positive_determination","latest_event_timestamp":"2026-10-02T17:55:11Z"}]}}],"modified":"2026-10-02T23:00:11.571024735Z","provider":"osv","upstream":["GO-2026-5932"],"references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:479d1cad-4dff-4734-bb40-866de95b5a61","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vmmv-qrr2-28wc","advisory_id":"479d1cad-4dff-4734-bb40-866de95b5a61","event_types":["advisory"],"published_at":"2026-10-25T22:48:59.879361+00:00","technologies":["core-osv","tigera-operator-fips-1-44"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T17:55:07+00:00","detail_url":"/events/71435"}]}},{"id":71060,"cve_ids":["CVE-2026-87910"],"payload":{"kind":"advisory","title":"CGA-w3w8-6cvm-f8mf","summary":"CGA-w3w8-6cvm-f8mf","evidence":"osv:CGA-w3w8-6cvm-f8mf","products":[{"name":{"value":"python-3.13","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.13","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w3w8-6cvm-f8mf","aliases":["CGA-w3w8-6cvm-f8mf"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/chainguard/python-3.13?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w3w8-6cvm-f8mf.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15_git20260917-r0","component_type":"apk","component_version":"3.13.15_git20260917-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/wolfi/python-3.13?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w3w8-6cvm-f8mf.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15_git20260917-r0","component_type":"apk","component_version":"3.13.15_git20260917-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}}],"modified":"2026-10-02T23:00:11.624634211Z","provider":"osv","upstream":["CVE-2026-87910","GHSA-rj44-3777-mh5x"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87910.json","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","https://nvd.nist.gov/vuln/detail/CVE-2026-87910","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/pull/157266","https://github.com/python/cpython","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3"]},"related_cves":[{"value":"CVE-2026-87910","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6346a19e-b559-43e8-a68b-ef19bc1afc28","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-87910","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w3w8-6cvm-f8mf","advisory_id":"6346a19e-b559-43e8-a68b-ef19bc1afc28","event_types":["advisory"],"published_at":"2026-10-25T22:48:59.116563+00:00","technologies":["core-osv","python-3-13"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T21:55:07+00:00","detail_url":"/advisories/advisory%3A6346a19e-b559-43e8-a68b-ef19bc1afc28","group":{"id":"advisory:6346a19e-b559-43e8-a68b-ef19bc1afc28","revision":1,"primary_event_id":71434,"change":"published","superseded_by":[],"changed":{"id":71434,"cve_ids":["CVE-2026-87910"],"payload":{"kind":"advisory","title":"CGA-w3w8-6cvm-f8mf","summary":"CGA-w3w8-6cvm-f8mf","evidence":"osv:CGA-w3w8-6cvm-f8mf","products":[{"name":{"value":"python-3.13","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.13","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w3w8-6cvm-f8mf","aliases":["CGA-w3w8-6cvm-f8mf"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/chainguard/python-3.13?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w3w8-6cvm-f8mf.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15_git20260917-r0","component_type":"apk","component_version":"3.13.15_git20260917-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/wolfi/python-3.13?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w3w8-6cvm-f8mf.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15_git20260917-r0","component_type":"apk","component_version":"3.13.15_git20260917-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}}],"modified":"2026-10-02T23:00:11.624634211Z","provider":"osv","upstream":["CVE-2026-87910","GHSA-rj44-3777-mh5x"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87910.json","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","https://nvd.nist.gov/vuln/detail/CVE-2026-87910","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/pull/157266","https://github.com/python/cpython","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3"]},"related_cves":[{"value":"CVE-2026-87910","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6346a19e-b559-43e8-a68b-ef19bc1afc28","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-87910","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w3w8-6cvm-f8mf","advisory_id":"6346a19e-b559-43e8-a68b-ef19bc1afc28","event_types":["advisory"],"published_at":"2026-10-25T22:48:59.116563+00:00","technologies":["core-osv","python-3-13"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T21:55:07+00:00","detail_url":"/events/71434"},"members":[{"id":71434,"cve_ids":["CVE-2026-87910"],"payload":{"kind":"advisory","title":"CGA-w3w8-6cvm-f8mf","summary":"CGA-w3w8-6cvm-f8mf","evidence":"osv:CGA-w3w8-6cvm-f8mf","products":[{"name":{"value":"python-3.13","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.13","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w3w8-6cvm-f8mf","aliases":["CGA-w3w8-6cvm-f8mf"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/chainguard/python-3.13?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w3w8-6cvm-f8mf.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15_git20260917-r0","component_type":"apk","component_version":"3.13.15_git20260917-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/wolfi/python-3.13?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w3w8-6cvm-f8mf.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15_git20260917-r0","component_type":"apk","component_version":"3.13.15_git20260917-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}}],"modified":"2026-10-02T23:00:11.624634211Z","provider":"osv","upstream":["CVE-2026-87910","GHSA-rj44-3777-mh5x"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87910.json","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","https://nvd.nist.gov/vuln/detail/CVE-2026-87910","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/pull/157266","https://github.com/python/cpython","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3"]},"related_cves":[{"value":"CVE-2026-87910","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6346a19e-b559-43e8-a68b-ef19bc1afc28","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-87910","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w3w8-6cvm-f8mf","advisory_id":"6346a19e-b559-43e8-a68b-ef19bc1afc28","event_types":["advisory"],"published_at":"2026-10-25T22:48:59.116563+00:00","technologies":["core-osv","python-3-13"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T21:55:07+00:00","detail_url":"/events/71434"}]}},{"id":71059,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-vrg8-5xg5-p6w7","summary":"CGA-vrg8-5xg5-p6w7","evidence":"osv:CGA-vrg8-5xg5-p6w7","products":[{"name":{"value":"elasticsearch-9.2-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vrg8-5xg5-p6w7","aliases":["CGA-vrg8-5xg5-p6w7"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r18"}]}],"package":{"name":"elasticsearch-9.2-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-9.2-iamguarded-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vrg8-5xg5-p6w7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/opt/iamguarded/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:54:01Z"}]}}],"modified":"2026-10-02T23:00:11.570906646Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6ecc5e96-5173-47f6-aabb-ca782ccdf0ba","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vrg8-5xg5-p6w7","advisory_id":"6ecc5e96-5173-47f6-aabb-ca782ccdf0ba","event_types":["advisory"],"published_at":"2026-10-25T22:48:57.96786+00:00","technologies":["core-osv","elasticsearch-9-2-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:45+00:00","detail_url":"/advisories/advisory%3A6ecc5e96-5173-47f6-aabb-ca782ccdf0ba","group":{"id":"advisory:6ecc5e96-5173-47f6-aabb-ca782ccdf0ba","revision":1,"primary_event_id":71433,"change":"published","superseded_by":[],"changed":{"id":71433,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-vrg8-5xg5-p6w7","summary":"CGA-vrg8-5xg5-p6w7","evidence":"osv:CGA-vrg8-5xg5-p6w7","products":[{"name":{"value":"elasticsearch-9.2-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vrg8-5xg5-p6w7","aliases":["CGA-vrg8-5xg5-p6w7"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r18"}]}],"package":{"name":"elasticsearch-9.2-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-9.2-iamguarded-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vrg8-5xg5-p6w7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/opt/iamguarded/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:54:01Z"}]}}],"modified":"2026-10-02T23:00:11.570906646Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6ecc5e96-5173-47f6-aabb-ca782ccdf0ba","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vrg8-5xg5-p6w7","advisory_id":"6ecc5e96-5173-47f6-aabb-ca782ccdf0ba","event_types":["advisory"],"published_at":"2026-10-25T22:48:57.96786+00:00","technologies":["core-osv","elasticsearch-9-2-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:45+00:00","detail_url":"/events/71433"},"members":[{"id":71433,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-vrg8-5xg5-p6w7","summary":"CGA-vrg8-5xg5-p6w7","evidence":"osv:CGA-vrg8-5xg5-p6w7","products":[{"name":{"value":"elasticsearch-9.2-iamguarded-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r18","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vrg8-5xg5-p6w7","aliases":["CGA-vrg8-5xg5-p6w7"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r18"}]}],"package":{"name":"elasticsearch-9.2-iamguarded-fips","purl":"pkg:apk/chainguard/elasticsearch-9.2-iamguarded-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vrg8-5xg5-p6w7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/opt/iamguarded/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:54:01Z"}]}}],"modified":"2026-10-02T23:00:11.570906646Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6ecc5e96-5173-47f6-aabb-ca782ccdf0ba","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vrg8-5xg5-p6w7","advisory_id":"6ecc5e96-5173-47f6-aabb-ca782ccdf0ba","event_types":["advisory"],"published_at":"2026-10-25T22:48:57.96786+00:00","technologies":["core-osv","elasticsearch-9-2-iamguarded-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:45+00:00","detail_url":"/events/71433"}]}},{"id":71058,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-phrg-p9v9-f4mx","summary":"CGA-phrg-p9v9-f4mx","evidence":"osv:CGA-phrg-p9v9-f4mx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-phrg-p9v9-f4mx","aliases":["CGA-phrg-p9v9-f4mx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-phrg-p9v9-f4mx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.057858719Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-phrg-p9v9-f4mx","advisory_id":"dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","event_types":["advisory"],"published_at":"2026-10-25T22:48:56.625967+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/advisories/advisory%3Adbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","group":{"id":"advisory:dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","revision":1,"primary_event_id":71432,"change":"published","superseded_by":[],"changed":{"id":71432,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-phrg-p9v9-f4mx","summary":"CGA-phrg-p9v9-f4mx","evidence":"osv:CGA-phrg-p9v9-f4mx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-phrg-p9v9-f4mx","aliases":["CGA-phrg-p9v9-f4mx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-phrg-p9v9-f4mx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.057858719Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-phrg-p9v9-f4mx","advisory_id":"dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","event_types":["advisory"],"published_at":"2026-10-25T22:48:56.625967+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/71432"},"members":[{"id":71432,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-phrg-p9v9-f4mx","summary":"CGA-phrg-p9v9-f4mx","evidence":"osv:CGA-phrg-p9v9-f4mx","products":[{"name":{"value":"elasticsearch-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.8-r19","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-phrg-p9v9-f4mx","aliases":["CGA-phrg-p9v9-f4mx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.8-r19"}]}],"package":{"name":"elasticsearch-9.2","purl":"pkg:apk/chainguard/elasticsearch-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-phrg-p9v9-f4mx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.18.6","component_type":"java-archive","component_version":"2.18.6","component_location":"/usr/share/elasticsearch/modules/x-pack-inference/jackson-core-2.18.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.057858719Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-phrg-p9v9-f4mx","advisory_id":"dbf2a0b5-e3de-46cc-ad4d-b41bd028d06f","event_types":["advisory"],"published_at":"2026-10-25T22:48:56.625967+00:00","technologies":["core-osv","elasticsearch-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:55:42+00:00","detail_url":"/events/71432"}]}},{"id":71057,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-m25m-xj6f-qpc7","summary":"CGA-m25m-xj6f-qpc7","evidence":"osv:CGA-m25m-xj6f-qpc7","products":[{"name":{"value":"kubeflow-pipelines-apiserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.17.2-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m25m-xj6f-qpc7","aliases":["CGA-m25m-xj6f-qpc7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-r5"}]}],"package":{"name":"kubeflow-pipelines-apiserver-fips","purl":"pkg:apk/chainguard/kubeflow-pipelines-apiserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m25m-xj6f-qpc7.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/python3.11/site-packages/urllib3-2.7.0.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:53:07Z"}]}}],"modified":"2026-10-02T23:00:10.794774475Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:94bfccbe-14dc-4786-acf6-b0055eec6e52","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m25m-xj6f-qpc7","advisory_id":"94bfccbe-14dc-4786-acf6-b0055eec6e52","event_types":["advisory"],"published_at":"2026-10-25T22:48:55.100084+00:00","technologies":["core-osv","kubeflow-pipelines-apiserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T10:45:45+00:00","detail_url":"/advisories/advisory%3A94bfccbe-14dc-4786-acf6-b0055eec6e52","group":{"id":"advisory:94bfccbe-14dc-4786-acf6-b0055eec6e52","revision":1,"primary_event_id":71431,"change":"published","superseded_by":[],"changed":{"id":71431,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-m25m-xj6f-qpc7","summary":"CGA-m25m-xj6f-qpc7","evidence":"osv:CGA-m25m-xj6f-qpc7","products":[{"name":{"value":"kubeflow-pipelines-apiserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.17.2-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m25m-xj6f-qpc7","aliases":["CGA-m25m-xj6f-qpc7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-r5"}]}],"package":{"name":"kubeflow-pipelines-apiserver-fips","purl":"pkg:apk/chainguard/kubeflow-pipelines-apiserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m25m-xj6f-qpc7.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/python3.11/site-packages/urllib3-2.7.0.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:53:07Z"}]}}],"modified":"2026-10-02T23:00:10.794774475Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:94bfccbe-14dc-4786-acf6-b0055eec6e52","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m25m-xj6f-qpc7","advisory_id":"94bfccbe-14dc-4786-acf6-b0055eec6e52","event_types":["advisory"],"published_at":"2026-10-25T22:48:55.100084+00:00","technologies":["core-osv","kubeflow-pipelines-apiserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T10:45:45+00:00","detail_url":"/events/71431"},"members":[{"id":71431,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-m25m-xj6f-qpc7","summary":"CGA-m25m-xj6f-qpc7","evidence":"osv:CGA-m25m-xj6f-qpc7","products":[{"name":{"value":"kubeflow-pipelines-apiserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.17.2-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m25m-xj6f-qpc7","aliases":["CGA-m25m-xj6f-qpc7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-r5"}]}],"package":{"name":"kubeflow-pipelines-apiserver-fips","purl":"pkg:apk/chainguard/kubeflow-pipelines-apiserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m25m-xj6f-qpc7.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/python3.11/site-packages/urllib3-2.7.0.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:53:07Z"}]}}],"modified":"2026-10-02T23:00:10.794774475Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:94bfccbe-14dc-4786-acf6-b0055eec6e52","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m25m-xj6f-qpc7","advisory_id":"94bfccbe-14dc-4786-acf6-b0055eec6e52","event_types":["advisory"],"published_at":"2026-10-25T22:48:55.100084+00:00","technologies":["core-osv","kubeflow-pipelines-apiserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T10:45:45+00:00","detail_url":"/events/71431"}]}},{"id":71056,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-m6p3-wx89-qrv5","summary":"CGA-m6p3-wx89-qrv5","evidence":"osv:CGA-m6p3-wx89-qrv5","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m6p3-wx89-qrv5","aliases":["CGA-m6p3-wx89-qrv5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6p3-wx89-qrv5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:28:00Z"}]}}],"modified":"2026-10-02T23:00:10.786481301Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6p3-wx89-qrv5","advisory_id":"7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","event_types":["advisory"],"published_at":"2026-10-25T22:48:53.940024+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:22:05+00:00","detail_url":"/advisories/advisory%3A7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","group":{"id":"advisory:7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","revision":1,"primary_event_id":71430,"change":"published","superseded_by":[],"changed":{"id":71430,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-m6p3-wx89-qrv5","summary":"CGA-m6p3-wx89-qrv5","evidence":"osv:CGA-m6p3-wx89-qrv5","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m6p3-wx89-qrv5","aliases":["CGA-m6p3-wx89-qrv5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6p3-wx89-qrv5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:28:00Z"}]}}],"modified":"2026-10-02T23:00:10.786481301Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6p3-wx89-qrv5","advisory_id":"7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","event_types":["advisory"],"published_at":"2026-10-25T22:48:53.940024+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:22:05+00:00","detail_url":"/events/71430"},"members":[{"id":71430,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-m6p3-wx89-qrv5","summary":"CGA-m6p3-wx89-qrv5","evidence":"osv:CGA-m6p3-wx89-qrv5","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m6p3-wx89-qrv5","aliases":["CGA-m6p3-wx89-qrv5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6p3-wx89-qrv5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:28:00Z"}]}}],"modified":"2026-10-02T23:00:10.786481301Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6p3-wx89-qrv5","advisory_id":"7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","event_types":["advisory"],"published_at":"2026-10-25T22:48:53.940024+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:22:05+00:00","detail_url":"/events/71430"}]}},{"id":71055,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-mgm3-7rm4-3prf","summary":"CGA-mgm3-7rm4-3prf","evidence":"osv:CGA-mgm3-7rm4-3prf","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mgm3-7rm4-3prf","aliases":["CGA-mgm3-7rm4-3prf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mgm3-7rm4-3prf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:12Z"}]}}],"modified":"2026-10-02T23:00:10.791844888Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6048e7dd-ba26-4753-8213-f85d3d99f0af","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mgm3-7rm4-3prf","advisory_id":"6048e7dd-ba26-4753-8213-f85d3d99f0af","event_types":["advisory"],"published_at":"2026-10-25T22:48:52.773082+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:19+00:00","detail_url":"/advisories/advisory%3A6048e7dd-ba26-4753-8213-f85d3d99f0af","group":{"id":"advisory:6048e7dd-ba26-4753-8213-f85d3d99f0af","revision":1,"primary_event_id":71429,"change":"published","superseded_by":[],"changed":{"id":71429,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-mgm3-7rm4-3prf","summary":"CGA-mgm3-7rm4-3prf","evidence":"osv:CGA-mgm3-7rm4-3prf","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mgm3-7rm4-3prf","aliases":["CGA-mgm3-7rm4-3prf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mgm3-7rm4-3prf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:12Z"}]}}],"modified":"2026-10-02T23:00:10.791844888Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6048e7dd-ba26-4753-8213-f85d3d99f0af","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mgm3-7rm4-3prf","advisory_id":"6048e7dd-ba26-4753-8213-f85d3d99f0af","event_types":["advisory"],"published_at":"2026-10-25T22:48:52.773082+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:19+00:00","detail_url":"/events/71429"},"members":[{"id":71429,"cve_ids":["CVE-2026-19032"],"payload":{"kind":"advisory","title":"CGA-mgm3-7rm4-3prf","summary":"CGA-mgm3-7rm4-3prf","evidence":"osv:CGA-mgm3-7rm4-3prf","products":[{"name":{"value":"logstash-fips-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mgm3-7rm4-3prf","aliases":["CGA-mgm3-7rm4-3prf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"logstash-fips-9.4","purl":"pkg:apk/chainguard/logstash-fips-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mgm3-7rm4-3prf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/jrjackson-0.5.2-java/lib/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:12Z"}]}}],"modified":"2026-10-02T23:00:10.791844888Z","provider":"osv","upstream":["CVE-2026-19032","GHSA-wjgm-6hv5-3cvf"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-19032","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6048e7dd-ba26-4753-8213-f85d3d99f0af","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mgm3-7rm4-3prf","advisory_id":"6048e7dd-ba26-4753-8213-f85d3d99f0af","event_types":["advisory"],"published_at":"2026-10-25T22:48:52.773082+00:00","technologies":["core-osv","logstash-fips-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:09:19+00:00","detail_url":"/events/71429"}]}},{"id":71054,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-mqmf-v44m-35vc","summary":"CGA-mqmf-v44m-35vc","evidence":"osv:CGA-mqmf-v44m-35vc","products":[{"name":{"value":"strimzi-kafka-operator-fips-cluster-operator","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.2.0-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mqmf-v44m-35vc","aliases":["CGA-mqmf-v44m-35vc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r6"}]}],"package":{"name":"strimzi-kafka-operator-fips-cluster-operator","purl":"pkg:apk/chainguard/strimzi-kafka-operator-fips-cluster-operator?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mqmf-v44m-35vc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.1.5","component_type":"java-archive","component_version":"3.1.5","component_location":"/opt/strimzi/lib/tools.jackson.core.jackson-databind-3.1.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:15:07Z"}]}}],"modified":"2026-10-02T23:00:10.778937524Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5bc5dd09-665b-49df-abd9-2e960c7ac60e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mqmf-v44m-35vc","advisory_id":"5bc5dd09-665b-49df-abd9-2e960c7ac60e","event_types":["advisory"],"published_at":"2026-10-25T22:48:47.419243+00:00","technologies":["core-osv","strimzi-kafka-operator-fips-cluster-operator"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:55+00:00","detail_url":"/advisories/advisory%3A5bc5dd09-665b-49df-abd9-2e960c7ac60e","group":{"id":"advisory:5bc5dd09-665b-49df-abd9-2e960c7ac60e","revision":1,"primary_event_id":71428,"change":"published","superseded_by":[],"changed":{"id":71428,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-mqmf-v44m-35vc","summary":"CGA-mqmf-v44m-35vc","evidence":"osv:CGA-mqmf-v44m-35vc","products":[{"name":{"value":"strimzi-kafka-operator-fips-cluster-operator","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.2.0-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mqmf-v44m-35vc","aliases":["CGA-mqmf-v44m-35vc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r6"}]}],"package":{"name":"strimzi-kafka-operator-fips-cluster-operator","purl":"pkg:apk/chainguard/strimzi-kafka-operator-fips-cluster-operator?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mqmf-v44m-35vc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.1.5","component_type":"java-archive","component_version":"3.1.5","component_location":"/opt/strimzi/lib/tools.jackson.core.jackson-databind-3.1.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:15:07Z"}]}}],"modified":"2026-10-02T23:00:10.778937524Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5bc5dd09-665b-49df-abd9-2e960c7ac60e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mqmf-v44m-35vc","advisory_id":"5bc5dd09-665b-49df-abd9-2e960c7ac60e","event_types":["advisory"],"published_at":"2026-10-25T22:48:47.419243+00:00","technologies":["core-osv","strimzi-kafka-operator-fips-cluster-operator"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:55+00:00","detail_url":"/events/71428"},"members":[{"id":71428,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-mqmf-v44m-35vc","summary":"CGA-mqmf-v44m-35vc","evidence":"osv:CGA-mqmf-v44m-35vc","products":[{"name":{"value":"strimzi-kafka-operator-fips-cluster-operator","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.2.0-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mqmf-v44m-35vc","aliases":["CGA-mqmf-v44m-35vc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r6"}]}],"package":{"name":"strimzi-kafka-operator-fips-cluster-operator","purl":"pkg:apk/chainguard/strimzi-kafka-operator-fips-cluster-operator?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mqmf-v44m-35vc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.1.5","component_type":"java-archive","component_version":"3.1.5","component_location":"/opt/strimzi/lib/tools.jackson.core.jackson-databind-3.1.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:15:07Z"}]}}],"modified":"2026-10-02T23:00:10.778937524Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5bc5dd09-665b-49df-abd9-2e960c7ac60e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mqmf-v44m-35vc","advisory_id":"5bc5dd09-665b-49df-abd9-2e960c7ac60e","event_types":["advisory"],"published_at":"2026-10-25T22:48:47.419243+00:00","technologies":["core-osv","strimzi-kafka-operator-fips-cluster-operator"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:55+00:00","detail_url":"/events/71428"}]}},{"id":71053,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-m5fv-66mp-4cvm","summary":"CGA-m5fv-66mp-4cvm","evidence":"osv:CGA-m5fv-66mp-4cvm","products":[{"name":{"value":"knative-kafka-broker-fips-1.23-dispatcher-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.23.1-r9","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m5fv-66mp-4cvm","aliases":["CGA-m5fv-66mp-4cvm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-r9"}]}],"package":{"name":"knative-kafka-broker-fips-1.23-dispatcher-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-fips-1.23-dispatcher-loom?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m5fv-66mp-4cvm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/app/libs/receiver-loom-1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:34:08Z"}]}}],"modified":"2026-10-02T23:00:10.720783364Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:36c3134c-96b3-40b4-839c-001e6d6bf028","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m5fv-66mp-4cvm","advisory_id":"36c3134c-96b3-40b4-839c-001e6d6bf028","event_types":["advisory"],"published_at":"2026-10-25T22:48:44.756645+00:00","technologies":["core-osv","knative-kafka-broker-fips-1-23-dispatcher-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:50:35+00:00","detail_url":"/advisories/advisory%3A36c3134c-96b3-40b4-839c-001e6d6bf028","group":{"id":"advisory:36c3134c-96b3-40b4-839c-001e6d6bf028","revision":1,"primary_event_id":71427,"change":"published","superseded_by":[],"changed":{"id":71427,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-m5fv-66mp-4cvm","summary":"CGA-m5fv-66mp-4cvm","evidence":"osv:CGA-m5fv-66mp-4cvm","products":[{"name":{"value":"knative-kafka-broker-fips-1.23-dispatcher-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.23.1-r9","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m5fv-66mp-4cvm","aliases":["CGA-m5fv-66mp-4cvm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-r9"}]}],"package":{"name":"knative-kafka-broker-fips-1.23-dispatcher-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-fips-1.23-dispatcher-loom?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m5fv-66mp-4cvm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/app/libs/receiver-loom-1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:34:08Z"}]}}],"modified":"2026-10-02T23:00:10.720783364Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:36c3134c-96b3-40b4-839c-001e6d6bf028","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m5fv-66mp-4cvm","advisory_id":"36c3134c-96b3-40b4-839c-001e6d6bf028","event_types":["advisory"],"published_at":"2026-10-25T22:48:44.756645+00:00","technologies":["core-osv","knative-kafka-broker-fips-1-23-dispatcher-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:50:35+00:00","detail_url":"/events/71427"},"members":[{"id":71427,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-m5fv-66mp-4cvm","summary":"CGA-m5fv-66mp-4cvm","evidence":"osv:CGA-m5fv-66mp-4cvm","products":[{"name":{"value":"knative-kafka-broker-fips-1.23-dispatcher-loom","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.23.1-r9","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m5fv-66mp-4cvm","aliases":["CGA-m5fv-66mp-4cvm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-r9"}]}],"package":{"name":"knative-kafka-broker-fips-1.23-dispatcher-loom","purl":"pkg:apk/chainguard/knative-kafka-broker-fips-1.23-dispatcher-loom?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m5fv-66mp-4cvm.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/app/libs/receiver-loom-1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:34:08Z"}]}}],"modified":"2026-10-02T23:00:10.720783364Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:36c3134c-96b3-40b4-839c-001e6d6bf028","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m5fv-66mp-4cvm","advisory_id":"36c3134c-96b3-40b4-839c-001e6d6bf028","event_types":["advisory"],"published_at":"2026-10-25T22:48:44.756645+00:00","technologies":["core-osv","knative-kafka-broker-fips-1-23-dispatcher-loom"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:50:35+00:00","detail_url":"/events/71427"}]}},{"id":71052,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-m6rg-696q-pqjv","summary":"CGA-m6rg-696q-pqjv","evidence":"osv:CGA-m6rg-696q-pqjv","products":[{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m6rg-696q-pqjv","aliases":["CGA-m6rg-696q-pqjv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6rg-696q-pqjv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.1.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:20Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6rg-696q-pqjv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.1.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:20Z"}]}}],"modified":"2026-10-02T23:00:10.760670523Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8ffb7c99-23aa-48e2-a923-b9351358e203","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6rg-696q-pqjv","advisory_id":"8ffb7c99-23aa-48e2-a923-b9351358e203","event_types":["advisory"],"published_at":"2026-10-25T22:48:43.617159+00:00","technologies":["core-osv","management-api-for-apache-cassandra-5-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:58:54+00:00","detail_url":"/advisories/advisory%3A8ffb7c99-23aa-48e2-a923-b9351358e203","group":{"id":"advisory:8ffb7c99-23aa-48e2-a923-b9351358e203","revision":1,"primary_event_id":71426,"change":"published","superseded_by":[],"changed":{"id":71426,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-m6rg-696q-pqjv","summary":"CGA-m6rg-696q-pqjv","evidence":"osv:CGA-m6rg-696q-pqjv","products":[{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m6rg-696q-pqjv","aliases":["CGA-m6rg-696q-pqjv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6rg-696q-pqjv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.1.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:20Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6rg-696q-pqjv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.1.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:20Z"}]}}],"modified":"2026-10-02T23:00:10.760670523Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8ffb7c99-23aa-48e2-a923-b9351358e203","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6rg-696q-pqjv","advisory_id":"8ffb7c99-23aa-48e2-a923-b9351358e203","event_types":["advisory"],"published_at":"2026-10-25T22:48:43.617159+00:00","technologies":["core-osv","management-api-for-apache-cassandra-5-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:58:54+00:00","detail_url":"/events/71426"},"members":[{"id":71426,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-m6rg-696q-pqjv","summary":"CGA-m6rg-696q-pqjv","evidence":"osv:CGA-m6rg-696q-pqjv","products":[{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"management-api-for-apache-cassandra-5.0","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.126-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m6rg-696q-pqjv","aliases":["CGA-m6rg-696q-pqjv"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/chainguard/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6rg-696q-pqjv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.1.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:20Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.126-r1"}]}],"package":{"name":"management-api-for-apache-cassandra-5.0","purl":"pkg:apk/wolfi/management-api-for-apache-cassandra-5.0?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6rg-696q-pqjv.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/opt/management-api/datastax-mgmtapi-agent-4.1.x-0.1.0-SNAPSHOT.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:06:20Z"}]}}],"modified":"2026-10-02T23:00:10.760670523Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8ffb7c99-23aa-48e2-a923-b9351358e203","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6rg-696q-pqjv","advisory_id":"8ffb7c99-23aa-48e2-a923-b9351358e203","event_types":["advisory"],"published_at":"2026-10-25T22:48:43.617159+00:00","technologies":["core-osv","management-api-for-apache-cassandra-5-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:58:54+00:00","detail_url":"/events/71426"}]}},{"id":71051,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-h7m3-98fv-28x7","summary":"CGA-h7m3-98fv-28x7","evidence":"osv:CGA-h7m3-98fv-28x7","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-h7m3-98fv-28x7","aliases":["CGA-h7m3-98fv-28x7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h7m3-98fv-28x7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-integration-kafka-12.1.7-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.6/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:57:59Z"}]}}],"modified":"2026-10-02T23:00:10.510205345Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6b567fb2-0691-43b0-863a-02f4d59d0918","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h7m3-98fv-28x7","advisory_id":"6b567fb2-0691-43b0-863a-02f4d59d0918","event_types":["advisory"],"published_at":"2026-10-25T22:48:34.640663+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:49+00:00","detail_url":"/advisories/advisory%3A6b567fb2-0691-43b0-863a-02f4d59d0918","group":{"id":"advisory:6b567fb2-0691-43b0-863a-02f4d59d0918","revision":1,"primary_event_id":71425,"change":"published","superseded_by":[],"changed":{"id":71425,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-h7m3-98fv-28x7","summary":"CGA-h7m3-98fv-28x7","evidence":"osv:CGA-h7m3-98fv-28x7","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-h7m3-98fv-28x7","aliases":["CGA-h7m3-98fv-28x7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h7m3-98fv-28x7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-integration-kafka-12.1.7-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.6/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:57:59Z"}]}}],"modified":"2026-10-02T23:00:10.510205345Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6b567fb2-0691-43b0-863a-02f4d59d0918","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h7m3-98fv-28x7","advisory_id":"6b567fb2-0691-43b0-863a-02f4d59d0918","event_types":["advisory"],"published_at":"2026-10-25T22:48:34.640663+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:49+00:00","detail_url":"/events/71425"},"members":[{"id":71425,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-h7m3-98fv-28x7","summary":"CGA-h7m3-98fv-28x7","evidence":"osv:CGA-h7m3-98fv-28x7","products":[{"name":{"value":"logstash-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-h7m3-98fv-28x7","aliases":["CGA-h7m3-98fv-28x7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r4"}]}],"package":{"name":"logstash-9.5","purl":"pkg:apk/chainguard/logstash-9.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h7m3-98fv-28x7.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-integration-kafka-12.1.7-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.21.6/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:57:59Z"}]}}],"modified":"2026-10-02T23:00:10.510205345Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6b567fb2-0691-43b0-863a-02f4d59d0918","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h7m3-98fv-28x7","advisory_id":"6b567fb2-0691-43b0-863a-02f4d59d0918","event_types":["advisory"],"published_at":"2026-10-25T22:48:34.640663+00:00","technologies":["core-osv","logstash-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:18:49+00:00","detail_url":"/events/71425"}]}},{"id":71050,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-h9gh-7prj-j9c5","summary":"CGA-h9gh-7prj-j9c5","evidence":"osv:CGA-h9gh-7prj-j9c5","products":[{"name":{"value":"request-9047-keycloak-fips-26.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"26.5.7-r31","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-h9gh-7prj-j9c5","aliases":["CGA-h9gh-7prj-j9c5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.5.7-r31"}]}],"package":{"name":"request-9047-keycloak-fips-26.5","purl":"pkg:apk/chainguard/request-9047-keycloak-fips-26.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h9gh-7prj-j9c5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/keycloak/lib/lib/main/org.keycloak.keycloak-sssd-federation-26.5.7.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:21:09Z"}]}}],"modified":"2026-10-02T23:00:10.506288972Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f2e3d089-f4d9-410c-b886-03a31a9e74c7","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h9gh-7prj-j9c5","advisory_id":"f2e3d089-f4d9-410c-b886-03a31a9e74c7","event_types":["advisory"],"published_at":"2026-10-25T22:48:32.882312+00:00","technologies":["core-osv","request-9047-keycloak-fips-26-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:32+00:00","detail_url":"/advisories/advisory%3Af2e3d089-f4d9-410c-b886-03a31a9e74c7","group":{"id":"advisory:f2e3d089-f4d9-410c-b886-03a31a9e74c7","revision":1,"primary_event_id":71424,"change":"published","superseded_by":[],"changed":{"id":71424,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-h9gh-7prj-j9c5","summary":"CGA-h9gh-7prj-j9c5","evidence":"osv:CGA-h9gh-7prj-j9c5","products":[{"name":{"value":"request-9047-keycloak-fips-26.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"26.5.7-r31","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-h9gh-7prj-j9c5","aliases":["CGA-h9gh-7prj-j9c5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.5.7-r31"}]}],"package":{"name":"request-9047-keycloak-fips-26.5","purl":"pkg:apk/chainguard/request-9047-keycloak-fips-26.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h9gh-7prj-j9c5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/keycloak/lib/lib/main/org.keycloak.keycloak-sssd-federation-26.5.7.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:21:09Z"}]}}],"modified":"2026-10-02T23:00:10.506288972Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f2e3d089-f4d9-410c-b886-03a31a9e74c7","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h9gh-7prj-j9c5","advisory_id":"f2e3d089-f4d9-410c-b886-03a31a9e74c7","event_types":["advisory"],"published_at":"2026-10-25T22:48:32.882312+00:00","technologies":["core-osv","request-9047-keycloak-fips-26-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:32+00:00","detail_url":"/events/71424"},"members":[{"id":71424,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-h9gh-7prj-j9c5","summary":"CGA-h9gh-7prj-j9c5","evidence":"osv:CGA-h9gh-7prj-j9c5","products":[{"name":{"value":"request-9047-keycloak-fips-26.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"26.5.7-r31","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-h9gh-7prj-j9c5","aliases":["CGA-h9gh-7prj-j9c5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.5.7-r31"}]}],"package":{"name":"request-9047-keycloak-fips-26.5","purl":"pkg:apk/chainguard/request-9047-keycloak-fips-26.5?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h9gh-7prj-j9c5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/keycloak/lib/lib/main/org.keycloak.keycloak-sssd-federation-26.5.7.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:21:09Z"}]}}],"modified":"2026-10-02T23:00:10.506288972Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f2e3d089-f4d9-410c-b886-03a31a9e74c7","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h9gh-7prj-j9c5","advisory_id":"f2e3d089-f4d9-410c-b886-03a31a9e74c7","event_types":["advisory"],"published_at":"2026-10-25T22:48:32.882312+00:00","technologies":["core-osv","request-9047-keycloak-fips-26-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:12:32+00:00","detail_url":"/events/71424"}]}}],"next_after":71079,"next_before":71050}