Package
hadoop-fips-3.3.6
Component
jackson-core
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
The flagged jackson-core/jackson-databind (2.12.1) is shaded into the Tencent COS SDK bundle cos_api-bundle-5.6.69 and relocated to com.qcloud.cos.thirdparty.com.fasterxml.jackson; the jar contains no unrelocated com.fasterxml classes, so only the COS SDK itself can use this copy. The SDK uses it only for its own credential, transfer-state, crypto-material and model JSON (com.qcloud.cos.utils.Jackson, PersistableTransfer, ContentCryptoMaterial, InstanceCredentialsFetcher). Verified against the SDK bytecode: no SDK class references @JsonTypeInfo, @JsonIdentityInfo or default typing (required by CVE-2026-91776, CVE-2026-91777 and CVE-2026-83557), no SDK class has a java.net.InetAddress or java.nio.file.Path member for jackson to bind (CVE-2026-77310, CVE-2026-19032), and none creates a parser over java.io.DataInput (CVE-2026-89425).
Status
Justification
Impact
The flagged jackson-core/jackson-databind (2.12.1) is shaded into the Tencent COS SDK bundle cos_api-bundle-5.6.69 and relocated to com.qcloud.cos.thirdparty.com.fasterxml.jackson; the jar contains no unrelocated com.fasterxml classes, so only the COS SDK itself can use this copy. The SDK uses it only for its own credential, transfer-state, crypto-material and model JSON (com.qcloud.cos.utils.Jackson, PersistableTransfer, ContentCryptoMaterial, InstanceCredentialsFetcher). Verified against the SDK bytecode: no SDK class references @JsonTypeInfo, @JsonIdentityInfo or default typing (required by CVE-2026-91776, CVE-2026-91777 and CVE-2026-83557), no SDK class has a java.net.InetAddress or java.nio.file.Path member for jackson to bind (CVE-2026-77310, CVE-2026-19032), and none creates a parser over java.io.DataInput (CVE-2026-89425).
Status