Skip to content

Bump jackson-databind to 2.21.4 (CVE-2026-54512, CVE-2026-54513) - #56

Merged
wresch merged 1 commit into
mainfrom
sre-1957-bump-jackson-databind
Jun 26, 2026
Merged

Bump jackson-databind to 2.21.4 (CVE-2026-54512, CVE-2026-54513)#56
wresch merged 1 commit into
mainfrom
sre-1957-bump-jackson-databind

Conversation

@tylergohl

@tylergohl tylergohl commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Bumps jackson-databind and jackson-datatype-jsr310 from 2.17.1 to 2.21.4 to remediate two high CVEs.

  • CVE-2026-54512 — PolymorphicTypeValidator bypass via generic type parameters
  • CVE-2026-54513 — array subtype allowlist bypass in allowIfSubTypeIsArray()

Both are fixed in jackson-databind 2.21.4 (released 2026-06-04). Verified the plugin compiles and packages against the new version.

Copilot AI review requested due to automatic review settings June 25, 2026 15:52

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@ciq-it-service-account

ciq-it-service-account commented Jun 25, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@tylergohl
tylergohl force-pushed the sre-1957-bump-jackson-databind branch from bfbbde4 to b7c5fd0 Compare June 25, 2026 16:02
@tylergohl
tylergohl marked this pull request as ready for review June 25, 2026 16:15
@tylergohl
tylergohl requested a review from a team as a code owner June 25, 2026 16:15

@wresch wresch left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@wresch
wresch merged commit 38f94e6 into main Jun 26, 2026
6 checks passed
@wresch
wresch deleted the sre-1957-bump-jackson-databind branch June 26, 2026 02:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

4 participants