CLEANSTART-2026-NR19315: jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.10.0.133078-r0 - Upgrade
Upgrade
cleanstart/strimzi-kafka-operatorto a version that resolves this vulnerability.Fixed in 1.3.0-r0
Event History
Frequently Asked Questions
Which deployments should be prioritized for assessment?
Prioritize deployments of cleanstart/sonarqube and cleanstart/strimzi-kafka-operator, which are the software entries associated with this advisory. The issue affects multiple packages, so review the referenced vulnerability details to identify the specific affected package paths.
What level of attacker access is indicated by the severity vector?
The supplied CVSS vector indicates network-based exploitation with low attack complexity, requiring no privileges and no user interaction. The stated impact is limited to availability, with no listed confidentiality or integrity impact.