Skip to content

Build: Bump jackson-databind to fix CVE-2026-68497 - #18318

Merged
pvary merged 1 commit into
apache:mainfrom
ebyhr:ebi/cve
Sep 30, 2026
Merged

Build: Bump jackson-databind to fix CVE-2026-68497#18318
pvary merged 1 commit into
apache:mainfrom
ebyhr:ebi/cve

Conversation

@ebyhr

@ebyhr ebyhr commented Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

CVE Scan is failing now: https://github.com/apache/iceberg/actions/runs/36661369135/job/109716664632

## Trivy CVE Scan Results — kafka-connect-runtime
Found 1 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-68497 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.21.3` | 2.18.10, 2.21.6, 2.22.2 | [CVE-2026-68497](https://avd.aquasec.com/nvd/cve-2026-68497) |
Error: Trivy found 1 HIGH/CRITICAL vulnerabilities in kafka-connect-runtime: CVE-2026-68497. See the 'Report Trivy scan results' step for details.

## Trivy CVE Scan Results — spark-runtime-3.5_2.12
Found 1 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-68497 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.18.8` | 2.18.10, 2.21.6, 2.22.2 | [CVE-2026-68497](https://avd.aquasec.com/nvd/cve-2026-68497) |
Error: Trivy found 1 HIGH/CRITICAL vulnerabilities in spark-runtime-3.5_2.12: CVE-2026-68497. See the 'Report Trivy scan results' step for details.

## Trivy CVE Scan Results — spark-runtime-4.0_2.13
Found 1 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-68497 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.18.8` | 2.18.10, 2.21.6, 2.22.2 | [CVE-2026-68497](https://avd.aquasec.com/nvd/cve-2026-68497) |
Error: Trivy found 1 HIGH/CRITICAL vulnerabilities in spark-runtime-4.0_2.13: CVE-2026-68497. See the 'Report Trivy scan results' step for details.

## Trivy CVE Scan Results — spark-runtime-4.1_2.13
Found 1 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-68497 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.21.4` | 2.18.10, 2.21.6, 2.22.2 | [CVE-2026-68497](https://avd.aquasec.com/nvd/cve-2026-68497) |
Error: Trivy found 1 HIGH/CRITICAL vulnerabilities in spark-runtime-4.1_2.13: CVE-2026-68497. See the 'Report Trivy scan results' step for details.

## Trivy CVE Scan Results — spark-runtime-4.2_2.13
Found 1 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-68497 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.21.4` | 2.18.10, 2.21.6, 2.22.2 | [CVE-2026-68497](https://avd.aquasec.com/nvd/cve-2026-68497) |
Error: Trivy found 1 HIGH/CRITICAL vulnerabilities in spark-runtime-4.2_2.13: CVE-2026-68497. See the 'Report Trivy scan results' step for details.

@github-actions github-actions Bot added the INFRA label Sep 30, 2026
ebyhr
ebyhr commented Sep 30, 2026
View reviewed changes
Comment thread .github/trivyignore/kafka-connect-runtime.trivyignore
GHSA-r7wm-3cxj-wff9
# jackson-databind CVE shaded into parquet-jackson 1.17.1, only fixed in
# jackson >= 2.18.10 / 2.21.6 / 2.22.2. Resolved once Apache Parquet is
# bumped to 1.18.1 (apache/iceberg#17321).

@ebyhr ebyhr Sep 30, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@manuzhang manuzhang mentioned this pull request Sep 30, 2026
Closed
@manuzhang
manuzhang requested a review from Fokko September 30, 2026 03:30
This was referenced Sep 30, 2026
Closed
Open
Open
@pvary
pvary merged commit 505c34e into apache:main Sep 30, 2026
43 checks passed
@pvary

pvary commented Sep 30, 2026

Copy link
Copy Markdown
Contributor

Thanks @ebyhr for the fix!

@ebyhr
ebyhr deleted the ebi/cve branch October 1, 2026 01:19
@ebyhr

ebyhr commented Oct 1, 2026

Copy link
Copy Markdown
Member Author

@pvary Thanks! We got another CVE failure today. Could you also review #18333?

@charliec05 charliec05 mentioned this pull request Oct 1, 2026
Closed
@sungwy sungwy mentioned this pull request Oct 5, 2026
Merged
Doubravka pushed a commit to dnanexus/iceberg that referenced this pull request Oct 30, 2026
@ebyhr @Doubravka
Build: Bump jackson versions (apache#18318)
b12be5b 
(cherry picked from commit 505c34e)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pvary pvary pvary approved these changes
@Fokko Fokko Awaiting requested review from Fokko

Assignees

No one assigned

Labels

build INFRA KAFKACONNECT

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ebyhr @pvary