High Severity CVE in transitive dependency `jackson-core`

Open

#1,198 opened on Mar 18, 2026 3 comments 0 reactions 1 assignee View on GitHub

@lahirumaramba is already working on this.

Since May 27, 2026.

Assessment

This issue has not been assessed yet.

Description

api: core

firebase-admin-java 9.8.0 has a transitive dependency on com.fasterxml.jackson.core:jackson-core:2.18.2, which has https://osv.dev/vulnerability/GHSA-72hv-8253-57qq

here's the dependencyInsights output:

com.fasterxml.jackson.core:jackson-core:2.18.2 -> 2.18.6
--- com.google.cloud:google-cloud-storage:2.63.0
+--- runtimeClasspath (requested com.google.cloud:google-cloud-storage:{strictly 2.63.0})
+--- com.google.firebase:firebase-admin:9.8.0

(i couldnt find an open source repo for google-cloud-storage otherwise would have reported it there. Also tried to report through the security channel, but they said it wasnt severe enough to track as a security bug and to report on Github)

Dominant language: Java
Stars: 620
Forks: 305
Avg merge: 3h 23m
Merged PRs (30d): 1

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[BUG] Unified agent on Bedrock Converse with no tools is unusable: an empty `toolConfig` is emitted and Bedrock rejects the request Open

bug untriaged

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

opensearch-project/ml-commons#5094 · Opened Sep 22, 2026
[Bug report] iceberg rest server load_table with refs fails precondition check "Cannot set metadata location with changes to table metadata: %s changes" for snapshots with statistics Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

apache/gravitino#13452 · Opened Sep 22, 2026
Support Test Project Creation for New Projects Open

emitter:client:csharp feature

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

microsoft/typespec#12027 · 1 comment · 1 reaction · Opened Sep 22, 2026
Job worker stops polling silently when a poll throws an Error Open

affects/8.10 affects/8.9 component/clients kind/bug likelihood/mid severity/mid

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

camunda/camunda#63825 · Opened Sep 22, 2026
Two open-case totals on one screen: the Programs tile says 15,858 and the nav badge says 15,868 Open

bug frontend maui-pilot

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

Taleef7/workwell#651 · 1 comment · Opened Sep 22, 2026

More Java issues