You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@spark.apache.org by "Anoopam Sharma (Jira)" <ji...@apache.org> on 2026/08/27 06:14:00 UTC

[jira] [Created] (SPARK-59041) [BUILD] Upgrade Jackson from 2.22.0 to 2.22.1

Anoopam Sharma created SPARK-59041:
--------------------------------------

             Summary: [BUILD] Upgrade Jackson from 2.22.0 to 2.22.1
                 Key: SPARK-59041
                 URL: https://issues.apache.org/jira/browse/SPARK-59041
             Project: Spark
          Issue Type: Improvement
          Components: Build
    Affects Versions: 5.0.0
            Reporter: Anoopam Sharma


Upgrade Jackson (fasterxml) from 2.22.0 to 2.22.1 to fix 4 CVEs:

 

- CVE-2026-54512 (HIGH 8.1): PolymorphicTypeValidator bypass via generic type parameters
- CVE-2026-54513 (HIGH 8.1): Second PTV bypass variant
- CVE-2026-54516 (MEDIUM 5.3): Deserialization issue
- CVE-2026-54517 (MEDIUM 5.3): Deserialization issue

 

Fixed in Jackson 2.22.1 (released 2026-07-20).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org