Skip to content

Upgrade jackson-databind to 2.21.5 to fix CVE-2026-59888 and CVE-2026-59889 - #50956

Closed
igraecao wants to merge 1 commit into
keycloak:mainfrom
igraecao:fix/jackson-databind-cve-2026-59888-59889
Closed

Upgrade jackson-databind to 2.21.5 to fix CVE-2026-59888 and CVE-2026-59889#50956
igraecao wants to merge 1 commit into
keycloak:mainfrom
igraecao:fix/jackson-databind-cve-2026-59888-59889

Conversation

@igraecao

Copy link
Copy Markdown

Closes #50955

Adds a jackson-bom 2.21.5 import before the Quarkus BOM in <dependencyManagement> to override the jackson-databind version from 2.21.2 to 2.21.5.

CVEs addressed:

  • CVE-2026-59888 (CVSS 6.5): @JsonIgnore bypass on Java Records with PropertyNamingStrategy. Fixed in 2.21.4.
  • CVE-2026-59889 (CVSS 6.5): @JsonUnwrapped bypasses @JsonView visibility. Fixed in 2.21.5.

Why not wait for Quarkus BOM update:
The Quarkus BOM includes jackson-databind 2.21.4 only from Quarkus 3.36.1 (jackson-databind 2.21.5 from Quarkus 3.37.0). KC currently uses Quarkus 3.33.2.1. Waiting for a full Quarkus uplift delays the security fix unnecessarily.

Risk assessment:
This is a patch-level bump (2.21.2 → 2.21.5) within the same minor. The jackson-databind 2.21.3/4/5 changelogs contain only bug fixes and security fixes with no API-breaking changes. KC does not use the affected patterns (Java Records for deserialization, @JsonView + @JsonUnwrapped) but the vulnerable library is shipped.

Note: This override can be removed once KC upgrades to Quarkus >= 3.37.0 which natively includes jackson-databind >= 2.22.0.

…-59889

Add jackson-bom 2.21.5 import before the Quarkus BOM to override the
jackson-databind version from 2.21.2 to 2.21.5. This is a patch-level
bump within the same minor version with no API-breaking changes.

CVE-2026-59888: Java Records using PropertyNamingStrategy bypass @JsonIgnore.
CVE-2026-59889: @JsonUnwrapped bypasses @JSONVIEW visibility check.

Both are fixed in jackson-databind 2.21.5. The Quarkus BOM will not include
this version until Quarkus 3.36.1+ (KC currently uses 3.33.2.1).

Closes keycloak#50955

Signed-off-by: Matvej Yli-Olli <matvej.yli-olli@ericsson.com>
Copilot AI review requested due to automatic review settings July 16, 2026 12:53
@igraecao
igraecao requested a review from a team as a code owner July 16, 2026 12:53

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Imports Jackson BOM 2.21.5 ahead of platform BOMs to address the referenced CVEs.

Changes:

  • Pins aligned Jackson dependencies to 2.21.5.
  • Ensures the Jackson BOM takes precedence over Quarkus dependency management.

Comment thread pom.xml
<dependencyManagement>

<dependencies>
<dependency>

@michalvavrik michalvavrik left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Quarkus BOM includes jackson-databind 2.21.4 only from Quarkus 3.36.1 (jackson-databind 2.21.5 from Quarkus 3.37.0). KC currently uses Quarkus 3.33.2.1. Waiting for a full Quarkus uplift delays the security fix unnecessarily.

Quarkus 3.33.3 will contain Jackson 2.21.4:

https://github.com/quarkusio/quarkus/blob/6b831f5311c2c0aff8f166800734d434dc3f988a/bom/application/pom.xml#L91

Release is due July 29 https://github.com/quarkusio/quarkus/wiki/3.33-LTS-Release-Planning#3333-lts. Will there be a Keycloak release before that?

I'll ask around if we can get in 2.21.5, let's see if we are lucky. Let's hold this for now.

@igraecao

Copy link
Copy Markdown
Author

Thanks for checking. We have a downstream release on July 24 (before 3.33.3), so we will carry the override independently for now. Once Quarkus 3.33.3 is adopted, the override becomes removable.

Still worth getting 2.21.5 into 3.33.3 if feasible - CVE-2026-59889 needs 2.21.5, not just 2.21.4.

Happy to close this PR if it lands via Quarkus instead. Let us know.

@michalvavrik

Copy link
Copy Markdown
Member

Thanks for checking. We have a downstream release on July 24 (before 3.33.3), so we will carry the override independently for now. Once Quarkus 3.33.3 is adopted, the override becomes removable.

Hello @igraecao , sure, if necessary, please continue with the override in your downstream release. I think it would be worth establish if anyone is affected, for which reason I recommend to discuss this topic in the linked issue first.

Just a nitpick: I think description of this PR gives a wrong impression that we would need to wait for Quarkus 3.36.1:

The Quarkus BOM includes jackson-databind 2.21.4 only from Quarkus 3.36.1 (jackson-databind 2.21.5 from Quarkus 3.37.0). KC currently uses Quarkus 3.33.2.1. Waiting for a full Quarkus uplift delays the security fix unnecessarily.

please consider adjusting your PR description. Thanks.

@vmuzikar

Copy link
Copy Markdown
Contributor

@igraecao Thank you for the PR, however as discussed on the parent issue we need to wait for a Quarkus upgrade.

@vmuzikar vmuzikar closed this Jul 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix

4 participants