Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
jackson-core 2.19.1 ships as the pre-built jar libs/jackson-core-2.19.1.jar nested inside the ZAP add-on bundle /zap/plugin/database-alpha-0.9.0.zap, where it is a transitive dependency of flyway-core 11.19.0. zaproxy is not built from source in this package: the build downloads the upstream ZAP release tarball and then fetches add-on bundles via "zap.sh -cmd -silent -addonupdate", so this jar cannot be rebuilt or bumped from the melange manifest. GHSA-r7wm-3cxj-wff9 requires jackson-core 2.21.4 or later. database-alpha-0.9.0, released 2025-12-15, is still the newest database add-on that upstream publishes for ZAP 2.17 per zap-admin ZapVersions-2.17.xml, so there is no newer add-on to pick up. Remediation depends on the upstream ZAP database add-on being released with an updated jackson-core. This matches the existing pending-upstream-fix advisory for GHSA-72hv-8253-57qq, the predecessor jackson-core issue in this same jar and location. A separate copy of jackson-core in commonlib-release-1.42.0.zap was already resolved by the upstream commonlib 1.43.0 update.
Status