Merge pull request #190 from Azure/fix/jackson-databind-cve-2026-54512

fix: pin Jackson to 2.21.4 to remediate jackson-databind CVEs (5.3.3)

Author: tanmaya-panda1

README.md

@@ -806,6 +806,7 @@ the [Release History](README.md#17-release-history) section of this document.
 | 5.3.0           | 2026-04-27   | <ul><li>Add wildcard (`*`) topic-to-table mapping support in `kusto.tables.topics.mapping` to provide a default ingestion configuration for topics that are not explicitly mapped</li></ul> |
 | 5.3.1           | 2026-05-20   | <ul><li>Security fix: Bump Netty to 4.2.13.Final to remediate CVE-2026-42583, CVE-2026-42579, CVE-2026-42584, CVE-2026-42587, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42585, and CVE-2026-42578</li></ul> |
 | 5.3.2           | 2026-06-15   | <ul><li>Security fix: Bump Netty to 4.2.15.Final to remediate CVE-2026-47244, CVE-2026-48043, CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691, CVE-2026-45673, and CVE-2026-45536</li></ul> |
+| 5.3.3           | 2026-07-01   | <ul><li>Security fix: Pin Jackson to 2.21.4 (via jackson-bom) to remediate CVE-2026-54512, CVE-2026-54513, and CVE-2026-54514 in jackson-databind, and align databind/annotations (previously 2.16.0) with jackson-core</li></ul> |
 
 ## 18. Contributing
 

pom.xml

@@ -8,7 +8,7 @@
     <artifactId>kafka-sink-azure-kusto</artifactId>
     <packaging>jar</packaging>
     <description>A Kafka Connect plugin for Azure Data Explorer (Kusto) Database</description>
-    <version>5.3.2</version>
+    <version>5.3.3</version>
     <properties>
         <!-- Compile dependencies -->
         <az.core.version>1.57.0</az.core.version>
@@ -47,8 +47,12 @@
         <!-- Shade plugin -->
         <maven.shade.plugin.version>3.6.0</maven.shade.plugin.version>
         <kusto.shade.prefix>kusto_kafka_connector_shaded</kusto.shade.prefix>
-        <!-- Netty version to resolve conflicts -->
-        <jackson.version>2.21.1</jackson.version>
+        <!-- Bumped 2026-07-01: jackson-bom 2.21.4 remediates CVE-2026-54512, CVE-2026-54513 (HIGH,
+             PolymorphicTypeValidator bypasses) and CVE-2026-54514 (InetSocketAddress eager DNS), and aligns
+             jackson-databind/annotations (previously 2.16.0) with jackson-core. CVE-2026-54515 (MEDIUM) is
+             fixed only in 2.21.5/2.18.9 (not yet published) or Jackson 3.1.4; bump to 2.21.5 when released.
+             See https://github.com/FasterXML/jackson-databind/security/advisories -->
+        <jackson.version>2.21.4</jackson.version>
         <!-- Bumped 2026-06-15: 4.2.15.Final remediates CVE-2026-47244, CVE-2026-48043 (netty-codec-http2),
              CVE-2026-44249, CVE-2026-45416 (netty-handler), CVE-2026-45674, CVE-2026-47691, CVE-2026-45673
              (netty-resolver-dns) and CVE-2026-45536 (netty-transport-native-epoll/kqueue).
@@ -65,6 +69,15 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Pin jackson-bom to ${jackson.version} so all com.fasterxml.jackson.* modules (core,
+                 databind, annotations, datatype) resolve to the same patched release -->
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <build>