Package
solr-fips-9-full
Component
jackson-databind
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
No Apache Hadoop release ships a fixed jackson. Solr's HDFS module in this package ships hadoop-client-runtime 3.4.3, which shades jackson-databind 2.12.7.1; this issue is fixed in 2.18.11. The Hadoop 3.4 line still pins the shaded version, and the newest Hadoop release, 3.5.0, shades 2.18.6. The shaded copy is part of Hadoop's release artifact and cannot be updated independently. Waiting for the first upstream release containing the fix.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-91777 https://github.com/advisories/GHSA-cxp5-3px4-pw24
Status