You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "Chia-Ping Tsai (Jira)" <ji...@apache.org> on 2026/09/01 08:35:00 UTC
[jira] [Resolved] (KAFKA-21004) [CVE-2026-68497][jackson-databind]
[ https://issues.apache.org/jira/browse/KAFKA-21004?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Chia-Ping Tsai resolved KAFKA-21004.
------------------------------------
Resolution: Fixed
trunk: https://github.com/apache/kafka/commit/5aa50d8981ccd0138518cf6b4d097f7a6734ba85
4.4: [https://github.com/apache/kafka/commit/3225ce490ef02f6c6c957db3b5683b96a973c8ed]
4.3: [https://github.com/apache/kafka/commit/f0a2be3d284464c4c98cff7a669cd8d6f3db8c41]
4.2: https://github.com/apache/kafka/commit/e3d4f4755deee0674536ab96e4a4c246499a3996
> [CVE-2026-68497][jackson-databind]
> ----------------------------------
>
> Key: KAFKA-21004
> URL: https://issues.apache.org/jira/browse/KAFKA-21004
> Project: Kafka
> Issue Type: Bug
> Reporter: Gergely Harmadás
> Assignee: Gergely Harmadás
> Priority: Major
> Fix For: 4.4.0, 4.2.2, 4.3.2
>
>
> The Jackson project reports: PolymorphicTypeValidator needs to validate generic type parameters too BasicPolymorphicTypeValidator setting allowIfSubTypeIsArray() should validate element type Add java.lang.Comparable in set of "unsafe" polymorphic base types @JsonView by-passed for @JsonUnwrapped Field/Setter properties @JsonView by-passed for some "setterless" creator properties @JsonView by-passed for unwrapped creator parameters Honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties Renamed @JsonIgnore'd setters can deserialize via private fields @JsonIgnore on Record property ignored with PropertyNamingStrategy Case-insensitive deserialization may use wrong @JsonIgnoreProperties Do not allow DNS resolution when deserializing InetAddress Improve InetSocketAddress deserialization Limit the supported URL schemes for java.nio.file.Path deserialization Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration
> *NVD URL :* [https://nvd.nist.gov/vuln/detail/cve-2026-68497] (not yet in the database)
> [https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.6] contains the fix
--
This message was sent by Atlassian Jira
(v8.20.10#820010)