[jira] [Created] (KAFKA-21004) [CVE-2026-68497][jackson-databind]

["Gergely Harmadás (Jira)" <ji...@apache.org>]

Gergely Harmadás created KAFKA-21004:
----------------------------------------

             Summary: [CVE-2026-68497][jackson-databind]
                 Key: KAFKA-21004
                 URL: https://issues.apache.org/jira/browse/KAFKA-21004
             Project: Kafka
          Issue Type: Bug
            Reporter: Gergely Harmadás
            Assignee: Gergely Harmadás


The Jackson project reports: PolymorphicTypeValidator needs to validate generic type parameters too BasicPolymorphicTypeValidator setting allowIfSubTypeIsArray() should validate element type Add java.lang.Comparable in set of "unsafe" polymorphic base types @JsonView by-passed for @JsonUnwrapped Field/Setter properties @JsonView by-passed for some "setterless" creator properties @JsonView by-passed for unwrapped creator parameters Honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties Renamed @JsonIgnore'd setters can deserialize via private fields @JsonIgnore on Record property ignored with PropertyNamingStrategy Case-insensitive deserialization may use wrong @JsonIgnoreProperties Do not allow DNS resolution when deserializing InetAddress Improve InetSocketAddress deserialization Limit the supported URL schemes for java.nio.file.Path deserialization Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration

*NVD URL :* [https://nvd.nist.gov/vuln/detail/cve-2026-68497] (not yet in the database)

[https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.6] contains the fix



--
This message was sent by Atlassian Jira
(v8.20.10#820010)