From 93ce46c7e0ec6044b9c7c55bce29545a1c44dd6e Mon Sep 17 00:00:00 2001
From: Matvej Yli-Olli <matvej.yli-olli@ericsson.com>
Date: Thu, 16 Jul 2026 15:53:12 +0300
Subject: [PATCH] Upgrade jackson-databind to 2.21.5 to fix CVE-2026-59888 and
 CVE-2026-59889

Add jackson-bom 2.21.5 import before the Quarkus BOM to override the
jackson-databind version from 2.21.2 to 2.21.5. This is a patch-level
bump within the same minor version with no API-breaking changes.

CVE-2026-59888: Java Records using PropertyNamingStrategy bypass @JsonIgnore.
CVE-2026-59889: @JsonUnwrapped bypasses @JsonView visibility check.

Both are fixed in jackson-databind 2.21.5. The Quarkus BOM will not include
this version until Quarkus 3.36.1+ (KC currently uses 3.33.2.1).

Closes #50955

Signed-off-by: Matvej Yli-Olli <matvej.yli-olli@ericsson.com>
---
 pom.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pom.xml b/pom.xml
index 8a2e87182c4d..455aeea8a592 100644
--- a/pom.xml
+++ b/pom.xml
@@ -331,6 +331,13 @@
     <dependencyManagement>
 
         <dependencies>
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>2.21.5</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>org.infinispan</groupId>
                 <artifactId>infinispan-bom</artifactId>