CVE--2026-54515 on 2.22.0 and earlier version .

[alamrehan]

CVE--2026-54515 on 2.22.0 and earlier version . They fix suggested in version 2.21.5. But this still not in repository. Any expected dat when this be published.

Another fix suggested is 3.1.4 but Azure SDK is not supporting this yet.

[pjfanning]

Releases will be done when they are ready. CVE-2026-54515 does not affect most users. You need to be using the non-standard feature to be affected.

2.22.0 is released but has this issue. 2.22.1 will have the fix along with forthcoming releases 2.21.5 and 2.18.9. I have submitted a fix for the GHSA and CVE entries.

[dbhattasali]

Do we have a tentative ETA - when the fixed version 2.22.1 will be released please?

[cowtowncoder]

@dbhattasali No. We will release it when a batch of fixes is ready and maintainer(s) have time to actually make ALL necessary releases -- within 2 weeks, I hope.

[cowtowncoder]

2.21.5 now released: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.5