From 7dfb3b1ce9f30b4f1911fd581be74867acd21ba4 Mon Sep 17 00:00:00 2001 From: Saurabh Jain Date: Tue, 28 Jul 2026 23:59:25 +0200 Subject: [PATCH] fix(security): bump jackson to 2.22.1 [skip-runtime-e2e] jackson.version was pinned at 2.17.0, which put jackson-databind 2.17.0 and (transitively) jackson-core 2.17.0 on every consumer's compile classpath. Seven advisories match that pin: jackson-core GHSA-r7wm-3cxj-wff9 High async parser maxNumberLength bypass GHSA-72hv-8253-57qq Moderate async parser number-length bypass jackson-databind CVE-2026-54512 High PTV bypass via generic type parameters CVE-2026-54513 High PTV array subtype allowlist bypass CVE-2026-54514 Moderate InetSocketAddress eager DNS resolution CVE-2026-54515 Moderate case-insensitive deserialization bypass CVE-2026-59888 Moderate @JsonIgnore bypass on record properties None of them are reachable from SDK code. All JSON goes through ObjectMapper blocking reads: across 444 compiled classes there is no reference to JsonFactory, createNonBlockingByteArrayParser or any async-feeder type, so the two jackson-core advisories cannot be hit; and polymorphic typing is never enabled (no activateDefaultTyping, no @JsonTypeInfo, no PolymorphicTypeValidator), which is the precondition for the two PTV bypasses. The bump is still warranted because the vulnerable jars ship to consumers, whose own code shares that classpath. 2.22.1 is the current Jackson release and is the version the platform examples already pin as a local override. Note that 2.19.x-2.21.3 and 2.22.0 do NOT clear the set; the floors are 2.18.9, 2.21.5 or 2.22.1. jackson-core is now declared explicitly rather than inherited from jackson-databind, so the published POM states a floor on the artifact that actually carries the advisories. No behavioural change. The same probe was run against both versions in a real JVM over real SDK types and the output is byte-for-byte identical: @JsonInclude(NON_NULL) omission, Instant ISO-8601 rendering and parsing at nanosecond precision, untyped Map number-type inference, unknown-property tolerance, escaping and StreamReadConstraints defaults. Jackson's Java 8 bytecode baseline is unchanged, so the Java 11 target is unaffected. mvn verify: 1325 unit tests, 12 integration tests, coverage gate met. Side-effect: jackson-databind 2.17.0 pulled net.bytebuddy:byte-buddy into compile scope and 2.22.1 does not, so that dependency drops off the consumer compile classpath. Refs getaxonflow/axonflow-enterprise#3110 Signed-off-by: Saurabh Jain --- CHANGELOG.md | 32 ++++++++++++++++++++++++++++++++ pom.xml | 15 ++++++++++++++- 2 files changed, 46 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 32ee5ca..367804f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Security + +- **Jackson bumped from 2.17.0 to 2.22.1**, and `jackson-core` is now declared + explicitly instead of being inherited transitively from `jackson-databind`. + Consumers of the SDK previously picked up `jackson-core:2.17.0` and + `jackson-databind:2.17.0` on their compile classpath. + + This clears seven advisories that matched the old pin: on `jackson-core`, + GHSA-r7wm-3cxj-wff9 (High) and GHSA-72hv-8253-57qq (Moderate), both + `maxNumberLength` bypasses in the **non-blocking (async) parser**; on + `jackson-databind`, CVE-2026-54512 and CVE-2026-54513 (both High, + `PolymorphicTypeValidator` allowlist bypasses) plus CVE-2026-54514, + CVE-2026-54515 and CVE-2026-59888 (Moderate). + + **The SDK itself did not reach any of these code paths.** It never constructs + a `JsonFactory` or an async parser (all JSON goes through `ObjectMapper` + blocking reads), and it never enables polymorphic typing, which is the + precondition for the `PolymorphicTypeValidator` bypasses. The bump matters + because the vulnerable jars land on the *consumer's* classpath, where the + same Jackson may be used by application code that does reach them. + + No behavioural change: `@JsonInclude(NON_NULL)` omission, `Instant` + ISO-8601 rendering and parsing (including nanosecond precision), untyped + `Map` number-type inference, unknown-property tolerance and + `StreamReadConstraints` defaults were all compared across the two versions + and are byte-for-byte identical. Jackson's Java 8 bytecode baseline is + unchanged, so the SDK's Java 11 target is unaffected. + + One transitive dependency disappears from the compile classpath as a + side-effect: `jackson-databind` 2.17.0 depended on `net.bytebuddy:byte-buddy` + and 2.22.1 does not. + ## [9.0.0] - 2026-07-18 ### Changed (BREAKING) diff --git a/pom.xml b/pom.xml index 6eaa825..6f4ade4 100644 --- a/pom.xml +++ b/pom.xml @@ -51,7 +51,12 @@ 4.12.0 - 2.17.0 + + 2.22.1 2.0.12 3.1.8 @@ -96,6 +101,14 @@ jackson-databind ${jackson.version} + + + com.fasterxml.jackson.core + jackson-core + ${jackson.version} + com.fasterxml.jackson.datatype jackson-datatype-jsr310