Package
elasticsearch-9.4
Component
jackson-databind
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
CVE-2026-54516 (GHSA-9fxm-vc8v-hj55, MODERATE) affects com.fasterxml.jackson.core:jackson-databind in the range >= 2.21.0, < 2.21.4 (fixed in 2.21.4). Elasticsearch's own managed jackson-databind is below this range and is not affected.
The flagged jackson-databind 2.21.3 classes are embedded inside the prebuilt Apache Parquet artifact parquet-hadoop-bundle (version 1.17.1), which the Parquet and Iceberg ES|QL data-source modules ship as a self-contained ("shaded") jar. Because the vulnerable jackson-databind is bundled within that jar rather than resolved as a standalone dependency, it cannot be remediated by overriding the jackson version at build time. Remediation requires a new Apache Parquet release of parquet-hadoop-bundle that embeds jackson-databind >= 2.21.4. parquet-hadoop-bundle 1.17.1 is currently the latest published release, so no fixed bundle is available yet. This advisory will be updated to fixed once such a release is available and adopted.
References:
Status