Package
celeborn-0.5
Component
jackson-databind
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
CVE-2026-19032 (https://github.com/advisories/GHSA-wjgm-6hv5-3cvf) is fixed in jackson-databind 2.18.10 on the 2.18 line. The vulnerable jackson-databind 2.12.7.1 is shaded inside hadoop-client-runtime-3.4.1.jar and can't be replaced separately from Hadoop. No Apache Hadoop release bundles a fixed version: 3.4.1 through 3.4.3 bundle 2.12.7.1 and 3.5.0 bundles 2.18.6 (https://repo1.maven.org/maven2/org/apache/hadoop/hadoop-project/3.5.0/hadoop-project-3.5.0.pom). The standalone jackson-databind jar in this package is already at a fixed version. Waiting for the first upstream release containing the fix.
Status