fix: bump Jackson to 2.21.5 to remediate CVE-2026-54515 (5.3.4) - #192
Merged
Tanmaya Panda (tanmaya-panda1) merged 1 commit intoJul 7, 2026
Merged
Conversation
jackson-databind 2.21.5 (published to Maven Central 2026-07-07) fixes CVE-2026-54515 (MEDIUM, CWE-915) — the @JsonIgnoreProperties bypass under ACCEPT_CASE_INSENSITIVE_PROPERTIES that remained open in 5.3.3 (2.21.4) because no fixed 2.x release existed yet. Single-line bump of jackson.version (propagated to all jackson modules via the imported jackson-bom). Bumps connector version to 5.3.4 and adds the release-history row. Verified: dependency tree + shipped uber jar bundle jackson-databind 2.21.5 (no 2.21.4 remnant); Trivy scan of the shipped jar reports zero CVEs; 127/127 unit tests pass on JDK 17. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Tanmaya Panda (tanmaya-panda1)
temporarily deployed
to
build
July 7, 2026 10:47 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Copilot started reviewing on behalf of
Tanmaya Panda (tanmaya-panda1)
July 7, 2026 13:36
View session
Contributor
There was a problem hiding this comment.
Pull request overview
🔍 Section A — Architectural Summary
This PR bumps the centrally-managed Jackson version to 2.21.5 via the imported jackson-bom to remediate CVE-2026-54515, and publishes connector 5.3.4 with a matching README release-history entry. The stated PR intent matches the diff.
| Component / Module | Change Type | Risk Level | Primary Concern |
|---|---|---|---|
pom.xml |
Dependency bump + release version | High | Ensure all Jackson artifacts resolve consistently to 2.21.5 via BOM/property pinning |
README.md |
Documentation | Low | Release history accuracy |
🛠️ Section B — Automated Findings (the review feed)
✅ PRAISE
- Centralized
jackson.version+jackson-bomimport keeps the remediation scoped and reduces the chance of partial/uneven Jackson upgrades.
💻 Section C — Code Generation Guardrails
No guardrail diffs required (no 🔴 CRITICAL /
Final verification checklist (based on what was verified in the diff/context)
- OWASP dependency-check clean (or all CVEs ≥ 7 explicitly suppressed with comment)
- No secrets, tokens, keys, or connection strings in code / tests / logs / fixtures
- No new dependency without license + provenance review
- No SNAPSHOT versions in production scopes
- TLS verification enforced on every new HTTP client
- All KQL composed with parameterized queries or strict allow-list
- Unit tests pass locally (
mvn test) - Integration tests added for new behavior or justified as N/A
- Regression test exists for every reported bug fix
- Logs do not leak tokens, keys, or connection strings
-
SinkTask.stopreleases every resource the change introduces -
preCommitreturns only durably-ingested offsets - Ingestion mapping kind matches the data format (#174 guard)
- DLQ + retry policy unchanged or intentionally updated with docs
- All new public config keys have default + doc + validator
- No per-record allocations / regex compilation / reflection in
put - Thread-shared state uses Atomics / ConcurrentHashMap / proper locking
- CHANGELOG / release notes updated for user-visible changes
Changes:
- Bump connector version
5.3.3→5.3.4. - Bump
jackson.version2.21.4→2.21.5(via importedjackson-bom). - Add
5.3.4entry to README release history.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| README.md | Adds release-history entry for 5.3.4 documenting the Jackson CVE remediation. |
| pom.xml | Bumps project version and centralized Jackson BOM version property to 2.21.5. |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediates CVE-2026-54515 (MEDIUM, CVSS 5.3, CWE-915) in
jackson-databind, re-flagged by the partner Confluent Hub scan against connector 5.3.3 (which shippedjackson-databind2.21.4).jackson-databind2.21.5 was published to Maven Central on 2026-07-07 and fixes this CVE. This is a one-line bump ofjackson.version, propagated to every jackson module via the importedjackson-bom.Why this was open until now
In 5.3.3 we pinned Jackson to 2.21.4, which cleared CVE-2026-54512/54513/54514 but not 54515 — the latter's fix (2.18.9 / 2.21.5 / 2.22.1 / 3.1.4) was not yet published upstream. 2.21.5 has now released, so the fix is a simple version bump.
CVE
@JsonIgnorePropertiesbypass underACCEPT_CASE_INSENSITIVE_PROPERTIES)References: GHSA-5jmj-h7xm-6q6v, fix commit 0e1b0b2 (PR FasterXML/jackson-databind#5964).
Changes
pom.xml:jackson.version2.21.4 to 2.21.5; connector version 5.3.3 to 5.3.4.README.md: release-history row for 5.3.4.Validation
com.fasterxml.jackson.core:*resolve to 2.21.5, zero 2.21.4 remnants (jackson-annotationsis 2.21 by Jackson's own BOM design).jackson-databind-2.21.5.jar.Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com