Package
apache-nifi-2.12
Component
jackson-databind
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Apache NiFi 2.12.0, the latest Apache NiFi release, includes Hazelcast 5.7.0 in its Hazelcast services bundle, and the Hazelcast jar shades jackson-databind 2.21.2 under com.hazelcast.shaded. CVE-2026-68497 is fixed in jackson-databind 2.21.6; this copy is part of Hazelcast's release artifact and cannot be updated independently. Hazelcast 5.7.0 is the latest Hazelcast release; Hazelcast's development branch already bundles jackson-databind 2.22.3, and Hazelcast does not publish patch releases for its open-source edition, so the update ships with its next minor or major release. Waiting for the first upstream release containing the fix.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-68497 https://github.com/advisories/GHSA-q4xh-88c3-wmh7 https://github.com/hazelcast/hazelcast/issues/26623 https://github.com/hazelcast/hazelcast/blob/dc14ffb45440555d74ced30b1a3512d494f6c0fd/hazelcast-parent/pom.xml#L106 https://repo1.maven.org/maven2/com/hazelcast/hazelcast/
Status