Package
apache-nifi
Component
jackson-databind
Latest update
6.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The vulnerable jackson-databind is present only as a copy shaded inside an upstream prebuilt artifact. The Hazelcast fat jar embeds jackson-databind 2.21.2 under a relocated package namespace (com/hazelcast/shaded/com/fasterxml/jackson/, with no unshaded copy present), so it cannot be upgraded independently of Hazelcast itself, and the latest available Hazelcast release, 5.7.0, still bundles the affected version. This is pending an upstream Hazelcast release that carries a fixed jackson-databind.
Status
Status