Package
celeborn-0.6
Component
jackson-databind
Latest update
6.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Not fixed upstream for this package: CVE-2026-59889 is fixed in jackson-databind 2.18.9 (https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh), but no Apache Hadoop release ships it. Celeborn in this package ships hadoop-client-runtime 3.4.2, which shades jackson-databind 2.12.7.1 inside the Hadoop client jar, and the Hadoop 3.4 line, including its development branch, still pins 2.12.7.1. The newest Hadoop release, 3.5.0, shades 2.18.6; the upgrade to 2.18.10 is on the Hadoop 3.5 development branch, which has not been released. The shaded copy is part of the Hadoop release artifact and cannot be updated independently. Waiting for the first upstream release containing the fix.
Status