Skip to content

Build: Bump jackson to fix CVE-2026-91776 CVE-2026-91777 - #18333

Merged
pvary merged 1 commit into
apache:mainfrom
ebyhr:ebi/cve2
Oct 1, 2026
Merged

Build: Bump jackson to fix CVE-2026-91776 CVE-2026-91777#18333
pvary merged 1 commit into
apache:mainfrom
ebyhr:ebi/cve2

Conversation

@ebyhr

@ebyhr ebyhr commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

https://github.com/apache/iceberg/actions/runs/36777659123/job/110099536782

## Trivy CVE Scan Results — kafka-connect-runtime
Found 4 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-91776 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.21.3` | 2.18.11, 2.21.7, 2.22.3 | [CVE-2026-91776](https://avd.aquasec.com/nvd/cve-2026-91776) |
| CVE-2026-91777 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.21.3` | 2.21.7, 2.18.11, 2.22.3 | [CVE-2026-91777](https://avd.aquasec.com/nvd/cve-2026-91777) |
| CVE-2026-91776 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.18.11, 2.21.7, 2.22.3 | [CVE-2026-91776](https://avd.aquasec.com/nvd/cve-2026-91776) |
| CVE-2026-91777 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.21.7, 2.18.11, 2.22.3 | [CVE-2026-91777](https://avd.aquasec.com/nvd/cve-2026-91777) |
Error: Trivy found 4 HIGH/CRITICAL vulnerabilities in kafka-connect-runtime: CVE-2026-91776, CVE-2026-91777, CVE-2026-91776, CVE-2026-91777. See the 'Report Trivy scan results' step for details.

## Trivy CVE Scan Results — azure-bundle
Found 2 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-91776 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.18.11, 2.21.7, 2.22.3 | [CVE-2026-91776](https://avd.aquasec.com/nvd/cve-2026-91776) |
| CVE-2026-91777 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.21.7, 2.18.11, 2.22.3 | [CVE-2026-91777](https://avd.aquasec.com/nvd/cve-2026-91777) |
Error: Trivy found 2 HIGH/CRITICAL vulnerabilities in azure-bundle: CVE-2026-91776, CVE-2026-91777. See the 'Report Trivy scan results' step for details.

## Trivy CVE Scan Results — gcp-bundle
Found 2 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-91776 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.18.11, 2.21.7, 2.22.3 | [CVE-2026-91776](https://avd.aquasec.com/nvd/cve-2026-91776) |
| CVE-2026-91777 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.21.7, 2.18.11, 2.22.3 | [CVE-2026-91777](https://avd.aquasec.com/nvd/cve-2026-91777) |
Error: Trivy found 2 HIGH/CRITICAL vulnerabilities in gcp-bundle: CVE-2026-91776, CVE-2026-91777. See the 'Report Trivy scan results' step for details.

## Trivy CVE Scan Results — spark-runtime-4.2_2.13
Found 2 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-91776 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.21.6` | 2.18.11, 2.21.7, 2.22.3 | [CVE-2026-91776](https://avd.aquasec.com/nvd/cve-2026-91776) |
| CVE-2026-91777 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.21.6` | 2.21.7, 2.18.11, 2.22.3 | [CVE-2026-91777](https://avd.aquasec.com/nvd/cve-2026-91777) |
Error: Trivy found 2 HIGH/CRITICAL vulnerabilities in spark-runtime-4.2_2.13: CVE-2026-91776, CVE-2026-91777. See the 'Report Trivy scan results' step for details.

## Trivy CVE Scan Results — flink-runtime-2.3
Found 2 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-91776 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.18.11, 2.21.7, 2.22.3 | [CVE-2026-91776](https://avd.aquasec.com/nvd/cve-2026-91776) |
| CVE-2026-91777 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.21.7, 2.18.11, 2.22.3 | [CVE-2026-91777](https://avd.aquasec.com/nvd/cve-2026-91777) |
Error: Trivy found 2 HIGH/CRITICAL vulnerabilities in flink-runtime-2.3: CVE-2026-91776, CVE-2026-91777. See the 'Report Trivy scan results' step for details.

## Trivy CVE Scan Results — open-api-test-fixtures-runtime
Found 2 HIGH/CRITICAL vulnerabilities.

| CVE | Severity | Package | Installed | Fixed | Link |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-91776 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.18.11, 2.21.7, 2.22.3 | [CVE-2026-91776](https://avd.aquasec.com/nvd/cve-2026-91776) |
| CVE-2026-91777 | HIGH | `com.fasterxml.jackson.core:jackson-databind` | `2.22.2` | 2.21.7, 2.18.11, 2.22.3 | [CVE-2026-91777](https://avd.aquasec.com/nvd/cve-2026-91777) |
Error: Trivy found 2 HIGH/CRITICAL vulnerabilities in open-api-test-fixtures-runtime: CVE-2026-91776, CVE-2026-91777. See the 'Report Trivy scan results' step for details.

@github-actions github-actions Bot added the INFRA label Oct 1, 2026
ebyhr
ebyhr commented Oct 1, 2026
View reviewed changes
Comment thread .github/trivyignore/kafka-connect-runtime.trivyignore
CVE-2026-68497
# jackson-databind CVEs shaded into parquet-jackson 1.17.1, only fixed in
# jackson >= 2.18.11 / 2.21.7 / 2.22.3. Resolved once Apache Parquet is
# bumped to 1.18.1 (apache/iceberg#17321).

@ebyhr ebyhr Oct 1, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ebyhr ebyhr mentioned this pull request Oct 1, 2026
Merged
@pvary
pvary merged commit f12ec1b into apache:main Oct 1, 2026
43 checks passed
@pvary

pvary commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Merged to main.
Thanks @ebyhr for the fix!

@charliec05 charliec05 mentioned this pull request Oct 1, 2026
Closed
Doubravka pushed a commit to dnanexus/iceberg that referenced this pull request Oct 30, 2026
@ebyhr @Doubravka
Build: Bump jackson versions (apache#18333)
b9cf604 
(cherry picked from commit f12ec1b)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pvary pvary pvary approved these changes

Assignees

No one assigned

Labels

build INFRA KAFKACONNECT

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ebyhr @pvary