Upgrade jackson-databind to 2.21.5 to fix CVE-2026-59888 and CVE-2026-59889 - #50956
Upgrade jackson-databind to 2.21.5 to fix CVE-2026-59888 and CVE-2026-59889#50956igraecao wants to merge 1 commit into
Conversation
…-59889 Add jackson-bom 2.21.5 import before the Quarkus BOM to override the jackson-databind version from 2.21.2 to 2.21.5. This is a patch-level bump within the same minor version with no API-breaking changes. CVE-2026-59888: Java Records using PropertyNamingStrategy bypass @JsonIgnore. CVE-2026-59889: @JsonUnwrapped bypasses @JSONVIEW visibility check. Both are fixed in jackson-databind 2.21.5. The Quarkus BOM will not include this version until Quarkus 3.36.1+ (KC currently uses 3.33.2.1). Closes keycloak#50955 Signed-off-by: Matvej Yli-Olli <matvej.yli-olli@ericsson.com>
| <dependencyManagement> | ||
|
|
||
| <dependencies> | ||
| <dependency> |
michalvavrik
left a comment
There was a problem hiding this comment.
The Quarkus BOM includes jackson-databind 2.21.4 only from Quarkus 3.36.1 (jackson-databind 2.21.5 from Quarkus 3.37.0). KC currently uses Quarkus 3.33.2.1. Waiting for a full Quarkus uplift delays the security fix unnecessarily.
Quarkus 3.33.3 will contain Jackson 2.21.4:
Release is due July 29 https://github.com/quarkusio/quarkus/wiki/3.33-LTS-Release-Planning#3333-lts. Will there be a Keycloak release before that?
I'll ask around if we can get in 2.21.5, let's see if we are lucky. Let's hold this for now.
|
Thanks for checking. We have a downstream release on July 24 (before 3.33.3), so we will carry the override independently for now. Once Quarkus 3.33.3 is adopted, the override becomes removable. Still worth getting 2.21.5 into 3.33.3 if feasible - CVE-2026-59889 needs 2.21.5, not just 2.21.4. Happy to close this PR if it lands via Quarkus instead. Let us know. |
Hello @igraecao , sure, if necessary, please continue with the override in your downstream release. I think it would be worth establish if anyone is affected, for which reason I recommend to discuss this topic in the linked issue first. Just a nitpick: I think description of this PR gives a wrong impression that we would need to wait for Quarkus 3.36.1:
please consider adjusting your PR description. Thanks. |
|
@igraecao Thank you for the PR, however as discussed on the parent issue we need to wait for a Quarkus upgrade. |
Closes #50955
Adds a
jackson-bom2.21.5 import before the Quarkus BOM in<dependencyManagement>to override the jackson-databind version from 2.21.2 to 2.21.5.CVEs addressed:
@JsonIgnorebypass on Java Records withPropertyNamingStrategy. Fixed in 2.21.4.@JsonUnwrappedbypasses@JsonViewvisibility. Fixed in 2.21.5.Why not wait for Quarkus BOM update:
The Quarkus BOM includes jackson-databind 2.21.4 only from Quarkus 3.36.1 (jackson-databind 2.21.5 from Quarkus 3.37.0). KC currently uses Quarkus 3.33.2.1. Waiting for a full Quarkus uplift delays the security fix unnecessarily.
Risk assessment:
This is a patch-level bump (2.21.2 → 2.21.5) within the same minor. The jackson-databind 2.21.3/4/5 changelogs contain only bug fixes and security fixes with no API-breaking changes. KC does not use the affected patterns (Java Records for deserialization,
@JsonView+@JsonUnwrapped) but the vulnerable library is shipped.Note: This override can be removed once KC upgrades to Quarkus >= 3.37.0 which natively includes jackson-databind >= 2.22.0.