A Spring Boot error page can reveal that an application is running, but it cannot identify the JSON parser version behind that application. This distinction matters after a cluster of jackson-databind vulnerabilities with current fixes for 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, plus later fixes for CVE-2026-68497 in 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2.
On November 5, 2026 at 02:50 Beijing time, app="Spring Boot" returned 29,124 matches and http.body="Whitelabel Error Page" returned 2,430,896. Both queries used page 1, page size 1, and sub_type=all. The body expression is roughly two orders of magnitude larger. It can match cached pages, documentation, test fixtures, and services that are not Spring Boot at all. It is a discovery signal, not a dependency inventory.
Jackson bugs with different failure modes
CVE-2026-77310 concerns eager DNS resolution when java.net.InetAddress is deserialized from untrusted text. CVE-2026-68497 concerns oversized numeric components in XML datatype strings that can consume worker CPU. CVE-2026-59888 and CVE-2026-59889 describe annotation and view bypasses in Java Records and unwrapped properties.
These are separate bugs with separate fixed versions and exploitation conditions. A scanner that reports jackson-databind from a top-level dependency may miss a shaded copy, a framework starter, or a service running an older container image. A public Spring Boot page says even less.
Inventory the application artifact
Start with the build system and the deployed artifact. Record the declared Jackson version, the resolved dependency tree, framework version, container image digest, and the date the image was rebuilt. Search for shaded jars and vendor packages. Compare all release lines against the fixed versions relevant to the service's branch.
Map the request models that bind untrusted JSON. Identify fields of type InetAddress, Duration, XMLGregorianCalendar, Java Records with naming strategies, and properties that combine views with unwrapped containers. These specific paths are more useful than a generic search for the word Jackson.
Add request size limits, field length limits, fail-on-unknown property settings where compatible, and explicit DTOs. Enable DNS egress logging for application workloads so the InetAddress issue is visible even before a request succeeds.
Use the whitelabel count carefully
The 2,430,896 body matches are not 2.4 million vulnerable applications. They are matches for a generic string and need ownership, product, and version evidence. The 29,124 application matches are a smaller population but still require version verification.
Use both expressions to find forgotten Spring Boot services, then confirm the artifact and dependency graph from an authenticated deployment record. Check staging, preview, and disaster-recovery environments because they may use older images. Rebuild patches through the normal pipeline and verify the running image digest after deployment.
The useful outcome is a list of applications with their effective Jackson versions and request-parsing conditions. A whitelabel page can reveal an orphaned service; it cannot tell a defender which parser path that service uses.