From d46681bded2cb4b81b47bb9e439d409a04288b25 Mon Sep 17 00:00:00 2001
From: Katherine Chen <katherine.chen@thetradedesk.com>
Date: Mon, 27 Jul 2026 12:48:20 +1000
Subject: [PATCH 1/2] [Security] Upgrade jackson to 2.21.4 and Netty to
 4.1.136.Final

Resolves HIGH-severity vulnerabilities flagged by the Trivy scan:
- jackson-databind: CVE-2026-54512 (RCE), CVE-2026-54513 (bypass) via jackson-bom 2.21.4.
- Netty: CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901.

UID2-7569 UID2-7570 UID2-7571 UID2-7572 UID2-7573 UID2-7574

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 pom.xml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index e1e39388..a60d3c23 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,8 @@
         <junit-jupiter.version>5.11.2</junit-jupiter.version>
         <uid2-shared.version>11.7.4</uid2-shared.version>
         <okta-jwt.version>0.5.10</okta-jwt.version>
-        <netty.version>4.1.135.Final</netty.version>
+        <netty.version>4.1.136.Final</netty.version>
+        <jackson.version>2.21.4</jackson.version>
         <image.version>${project.version}</image.version>
     </properties>
 
@@ -39,6 +40,14 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- Force jackson to a fixed version to resolve CVE-2026-54512, CVE-2026-54513 (UID2-7569, UID2-7570). -->
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-bom</artifactId>

From a61533daaa9dfa2d8507985ffc97838b4b9f1df6 Mon Sep 17 00:00:00 2001
From: Katherine Chen <katherine.chen@thetradedesk.com>
Date: Mon, 27 Jul 2026 16:25:11 +1000
Subject: [PATCH 2/2] [Security] Remove obsolete jackson CVE-2026-54512/54513
 .trivyignore suppression
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These entries (exp:2026-07-25) were the interim suppression from UID2-7364 while
awaiting a jackson fix, and they had already expired. This PR applies the real
fix (jackson 2.21.4), so the suppression is now dead cruft — removing it.

UID2-7569 UID2-7570

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .trivyignore | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.trivyignore b/.trivyignore
index 232c21d3..c0e23648 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -23,14 +23,6 @@ GHSA-72hv-8253-57qq exp:2026-09-01
 # Availability only (C:N/I:N/A:H). Tracking via UID2-7035; revisit on vert.x 5 migration.
 CVE-2026-42577 exp:2026-09-11
 
-# jackson-databind data-binding vulnerability - no upstream fix released yet (fix targets: 2.18.8, 2.21.4, 3.1.4)
-# jackson-databind is pulled in transitively via uid2-shared; the version fix is tracked in
-# uid2-shared (https://github.com/IABTechLab/uid2-shared/pull/631) and will flow here on the
-# next uid2-shared release. Suppressing in the interim.
-# See: UID2-7364
-CVE-2026-54512 exp:2026-07-25
-CVE-2026-54513 exp:2026-07-25
-
 # CVE-2026-2100 — p11-kit NULL dereference via C_DeriveKey in the Alpine base image.
 # uid2-admin is a pure Java service; the JVM uses JSSE for TLS and the bundled Java cacerts keystore for trust — it does
 # not load the native p11-kit PKCS#11 module loader and never calls C_DeriveKey, so the