Package
hadoop-fips-3.3.6
Component
jackson-databind
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
The flagged jackson-core/jackson-databind (2.10.3) is shaded into the Tencent COS SDK bundle cos_api-bundle-5.6.19 and relocated to com.qcloud.cos.thirdparty.com.fasterxml.jackson; the jar contains no unrelocated com.fasterxml classes, so only the COS SDK itself can use this copy. The SDK uses it only for its own credential, transfer-state and model JSON (com.qcloud.cos.utils.Jackson, PersistableTransfer, InstanceCredentialsFetcher). Verified against the SDK bytecode: no SDK class references @JsonTypeInfo, @JsonIdentityInfo or default typing (required by CVE-2026-91776 and CVE-2026-91777), no SDK class has a java.net.InetAddress or java.nio.file.Path member for jackson to bind (CVE-2026-77310, CVE-2026-19032), and none creates a parser over java.io.DataInput (CVE-2026-89425).
Status
Justification
Impact
The flagged jackson-core/jackson-databind (2.10.3) is shaded into the Tencent COS SDK bundle cos_api-bundle-5.6.19 and relocated to com.qcloud.cos.thirdparty.com.fasterxml.jackson; the jar contains no unrelocated com.fasterxml classes, so only the COS SDK itself can use this copy. The SDK uses it only for its own credential, transfer-state and model JSON (com.qcloud.cos.utils.Jackson, PersistableTransfer, InstanceCredentialsFetcher). Verified against the SDK bytecode: no SDK class references @JsonTypeInfo, @JsonIdentityInfo or default typing (required by CVE-2026-91776 and CVE-2026-91777), no SDK class has a java.net.InetAddress or java.nio.file.Path member for jackson to bind (CVE-2026-77310, CVE-2026-19032), and none creates a parser over java.io.DataInput (CVE-2026-89425).
Status