Package
kayenta-fips-2026.1
Component
jackson-databind
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Jackson 2.18.2 is bundled inside signalfx-java 1.0.49, a prebuilt shaded artifact that relocates jackson into its own namespace and uses it internally. The build cannot rewrite it: kayenta's own jackson family is already pinned to 2.18.9 in lockstep and every standalone jackson artifact shipped is patched, but the copy baked into the uber-JAR is not build-resolved. 1.0.49 is the latest published signalfx-java release and still bundles 2.18.2, so remediation requires an upstream release carrying patched jackson, followed by adoption in kayenta.
Status
Fixed version
2026.1.1-r2Status