Package
apache-nifi-2.12
Component
jackson-core
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The jackson-core copy in the Apache NiFi Iceberg Parquet writer bundle is shaded inside Apache Parquet's parquet-jackson jar under shaded.parquet and cannot be updated independently of Apache Parquet. CVE-2026-89425 is fixed in jackson-core 2.22.3. No Apache Parquet release ships it: 1.18.1, the latest release, shades jackson-core 2.22.2, and the 1.18.x and 1.19.x release branches and the development branch also pin 2.22.2. The upgrade to jackson-core 2.22.3 is open upstream and not yet merged. Apache NiFi 2.12.0 is the latest Apache NiFi release. Waiting for the first upstream release containing the fix.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-89425 https://github.com/advisories/GHSA-7hhh-6rmp-j9qf https://github.com/apache/parquet-java/pull/3834 https://github.com/apache/parquet-java/blob/f5fc25beecfc4fd50234cb589aa9b0efe4449f54/pom.xml#L78 https://repo1.maven.org/maven2/org/apache/parquet/parquet-jackson/
Status