Package
airflow-3
Component
jackson-databind
Latest update
Fixed version
3.3.0-r3
8.1
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
3.3.0-r3Status
Impact
jackson-databind 2.18.6 (CVE-2026-54513, BasicPolymorphicTypeValidator array-subtype allowlist bypass, fixed in 2.18.8) is shaded inside ray_dist.jar, the Ray Java cross-language runtime fat-JAR bundled unconditionally in the ray==2.56.0 PyPI wheel. ray is a hard dependency of apache-airflow-providers-google 22.1.0 on Python 3.13 (Vertex AI Ray integration), pinned by upstream Airflow 3.3.0 constraints-3.13; upstream's official image (default AIRFLOW_EXTRAS includes google) ships the identical JAR. The JAR is prebuilt binary payload backing ray.cross_language — not modifiable at package build time (pure-Python install, no Maven mechanism), and removal would diverge from upstream. Resolution requires upstream motion: Ray rebundling jackson-databind >= 2.18.8 in ray_dist.jar, or the airflow-google provider/constraint chain moving off the affected ray release.
Status