CLEANSTART-2026-LG95737

See a problem?

Import Source

https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json

JSON Data

https://api.osv.dev/v1/vulns/CLEANSTART-2026-LG95737

Upstream

CVE-2026-110879

Published

2026-11-07T00:38:17Z

Modified

2026-11-07T00:45:12Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...

Details

CVE-2026-110879 affects multiple packages. jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. See references for individual vulnerability details.

References

Affected packages

CleanStart

trino

Package

Name: trino
Purl: pkg:apk/cleanstart/trino

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

484-r1

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

wso2mi

Package

Name: wso2mi
Purl: pkg:apk/cleanstart/wso2mi?arch=noarch

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.3.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

wso2mi

Package

Name: wso2mi
Purl: pkg:apk/cleanstart/wso2mi?arch=noarch

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.4.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

wso2mi

Package

Name: wso2mi
Purl: pkg:apk/cleanstart/wso2mi?arch=noarch

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.5.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

sonarqube

Package

Name: sonarqube
Purl: pkg:apk/cleanstart/sonarqube

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

26.8.0.126808-r6

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

spark-sc213-jdk17-py312

Package

Name: spark-sc213-jdk17-py312
Purl: pkg:apk/cleanstart/spark-sc213-jdk17-py312

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.2.0-r8

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

kafka

Package

Name: kafka
Purl: pkg:apk/cleanstart/kafka

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.1.2-r6

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

sonarqube

Package

Name: sonarqube
Purl: pkg:apk/cleanstart/sonarqube

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

26.7.0.124771-r11

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

elasticsearch

Package

Name: elasticsearch
Purl: pkg:apk/cleanstart/elasticsearch?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.2.8-r11

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

elasticsearch

Package

Name: elasticsearch
Purl: pkg:apk/cleanstart/elasticsearch?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.2.8-r11

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

elasticsearch

Package

Name: elasticsearch
Purl: pkg:apk/cleanstart/elasticsearch?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.5-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

elasticsearch

Package

Name: elasticsearch
Purl: pkg:apk/cleanstart/elasticsearch?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.5-r2

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

elasticsearch

Package

Name: elasticsearch
Purl: pkg:apk/cleanstart/elasticsearch?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.5-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

elasticsearch

Package

Name: elasticsearch
Purl: pkg:apk/cleanstart/elasticsearch?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.5-r3

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

elasticsearch

Package

Name: elasticsearch
Purl: pkg:apk/cleanstart/elasticsearch?arch=x86_64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.3.8-r16

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"

elasticsearch

Package

Name: elasticsearch
Purl: pkg:apk/cleanstart/elasticsearch?arch=aarch64

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.3.8-r16

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-LG95737.json"