Package
kayenta-2026.2
Component
jackson-core
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
This detection is a copy of jackson-core 2.18.2 relocated inside the prebuilt signalfx-java 1.0.49 fat jar, which a dependency version override cannot replace. 1.0.49 is the latest signalfx-java release and still bundles jackson-core 2.18.2, so remediation requires a new upstream signalfx-java release.
Status
Status
Fixed version
2026.2.5-r2Status
Impact
Jackson 2.18.2 is bundled inside signalfx-java 1.0.49, a prebuilt shaded artifact that relocates jackson into its own namespace and uses it internally. The build cannot rewrite it: the standalone jackson family is already pinned to 2.18.9, but the copy baked into the uber-JAR is not build-resolved. 1.0.49 is the latest published signalfx-java release and still bundles 2.18.2, so remediation requires an upstream release carrying patched jackson.
Status