SUSE alert openSUSE-SU-2026:21201-1 (jackson-annotations, jackson-core, jackson-databind)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21201-1: important: Security update for jackson-annotations, jackson-core, jackson-databind
Date:
             
 
Fri, 03 Jul 2026 11:45:58 +0200
Message-ID:
             
 
<20260703094558.39FEEFCE5@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for jackson-annotations, jackson-core, jackson-databind
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21201-1
Rating: important
References:

  * bsc#1268603
  * bsc#1268897
  * bsc#1268898
  * bsc#1268899
  * bsc#1268902



Cross-References:

  * CVE-2026-54512
  * CVE-2026-54513
  * CVE-2026-54514
  * CVE-2026-54515



CVSS scores:

  * CVE-2026-54512 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-54513 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-54514 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  * CVE-2026-54515 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 4 vulnerabilities and has 5 bug fixes can now be installed.

Description:

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues

- CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type
parameters that allows
  arbitrary class instantiation (bsc#1268897).
- CVE-2026-54513: jackson-databind has an array subtype allowlist bypass in
BasicPolymorphicTypeValidator (bsc#1268898).
- CVE-2026-54514: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
- CVE-2026-54515: jackson-databind has case-insensitive deserialization bypasses per-property
@JsonIgnoreProperties
  (bsc#1268902).
- document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).

Changes for jackson-annotations:

- Update to 2.18.8
 * No changes since 2.17.3

Changes for jackson-core:

- Update to 2.18.8
 * Changes of 2.18.8
 + #1611: Apply number-length validator on streaming integer path
 of async parser
 * Changes of 2.18.7
 + #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints
 .getMaxDocumentLength()' set
 (bsc#1268603, GHSA-2m67-wjpj-xhg9)
 + #1600: Rework 3rd party licenses in jar
 + #1602: 'UTF8DataInputJsonParser' needs to enforce
 'StreamReadConstraints.maxNameLength' limit
 * Changes of 2.18.6
 + #1512: Number-parsing fix for 'UTF8DataInputJsonParser'
 + #1548: 'StreamReadConstraints.maxDocumentLength' not checked
 when creating parser with fixed buffer
 + #1555: Enforce 'StreamReadConstraints.maxNumberLength' for
 non-blocking (async) parser
 * Changes of 2.18.5
 + #1433: 'JsonParser#getNumberType()' throws
 'JsonParseException' when the current token is non-numeric
 instead of returning null
 + #1446: Invalid package reference to "java.lang.foreign" from
 'com.fasterxml.jackson.core:jackson-core' (from
 'FastDoubleParser')
 * Changes of 2.18.3
 + #1391: Fix issue where the parser can read back old number
 state when parsing later numbers
 + #1397: Jackson changes additional values to infinite in case
 of special JSON structures and existing infinite values
 + #1398: Fix issue that feature
 COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom
 characterEscape is used
 * Changes of 2.18.2
 + #1359: Non-surrogate characters being incorrectly combined
 when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is
 enabled
 * Changes of 2.18.1
 + #1353: Use fastdoubleparser 1.0.90
 * Changes of 2.18.
 + #223: 'UTF8JsonGenerator' writes supplementary characters as a
 surrogate pair: should use 4-byte encoding
 + #1230: Improve performance of 'float' and 'double' parsing
 from 'TextBuffer'
 + #1251: 'InternCache' replace synchronized with 'ReentrantLock'
 - the cache size limit is no longer strictly enforced for
 performance reasons but we should never go far about the limit
 + #1252: 'ThreadLocalBufferManager' replace synchronized with
 'ReentrantLock'
 + #1257: Increase InternCache default max size from 100 to 200
 + #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'
 + #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'
 classes to prevent use by downstream consumers
 + #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove
 from 3.0)
 + #1274: 'NUL'-corrupted keys, values on JSON serialization
 + #1277: Add back Java 22 optimisation in FastDoubleParser
 + #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()
 /getDecimalValue()' to avoid String allocation
 + #1305: Make helper methods of 'WriterBasedJsonGenerator'
 non-final to allow overriding
 + #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to
 limit maximum number of Tokens allowed per document#
 + #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'
 decoding proble

Changes for jackson-databind:

- Update to 2.18.8
 * Changes of 2.18.8
 + #5950: Improve 'UUIDeserializer' error handling
 + #5951: Improve 'InetSocketAddress' deserialization
 (bsc#1268899, CVE-2026-54514)
 + #5969: '@JsonView' by-passed for some "setterless" creator
 properties
 + #5971: '@JsonView' by-passed for unwrapped creator parameters
 + #5974: '@JsonIgnore' on Record property ignored with
 'PropertyNamingStrategy'
 + #5981: 'BasicPolymorphicTypeValidator' setting
 'allowIfSubTypeIsArray()' should validate element type
 (bsc#1268898, CVE-2026-54513)
 + #5988: 'PolymorphicTypeValidator' needs to validate generic
 type parameters too (bsc#1268897, CVE-2026-54512)
 + #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'
 fold case using JVM default locale (Turkish-I bug)
 * Changes of 2.18.4
 + #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on
 Record property ignored for deserialization
 + #5049: Duplicate creator property "b" (index 0 vs 1) on simple
 java record
 * Changes of 2.18.3
 + #4444: The 'KeyDeserializer' specified in the class with
 '@JsonDeserialize(keyUsing = ...)' is overwritten by the
 'KeyDeserializer' specified in the 'ObjectMapper'.
 + #4827: Subclassed Throwable deserialization fails since
 v2.18.0 - no creator index for property 'cause'
 + #4844: Fix wrapped array handling wrt 'null' by
 'StdDeserializer'
 + #4848: Avoid type pollution in 'StringCollectionDeserializer'
 + #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not
 work with multiple constructors since 2.18
 + #4878: When serializing a Map via
 Converter(StdDelegatingSerializer), a NullPointerException is
 thrown due to missing key serializer
 + #4908: Deserialization behavior change with @JsonCreator and
 @ConstructorProperties between 2.17 and 2.18
 + #4917: 'BigDecimal' deserialization issue when using
 '@JsonCreator'
 + #4920: Creator properties are ignored on abstract types when
 collecting bean properties, breaking AsExternalTypeDeserializer
 + #4922: Failing '@JsonMerge' with a custom Map
 + #4932: Conversion of 'MissingNode' throws
 'JsonProcessingException'
 * Changes of 2.18.2
 + #4733: Wrong serialization of Type Ids for certain types of
 Enum values
 + #4742: Deserialization with Builder, External type id,
 '@JsonCreator' failing
 + #4777: 'StdValueInstantiator.withArgsCreator' is now set for
 creators with no arguments
 + #4783 Possibly wrong behavior of @JsonMerge
 + #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'
 hides actual error
 + #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides
 '@JsonProperty' values
 + #4790: Fix '@JsonAnySetter' issue with "setter" method
 (related to #4639)
 + #4807: Improve 'FactoryBasedEnumDeserializer' to work better
 with XML module
 + #4810: Deserialization using '@JsonCreator' with renamed
 property failing (since 2.18)
 * Changes of 2.18.1
 + #4508: Deserialized JsonAnySetter field in Kotlin data class
 is null
 + #4639: @JsonAnySetter on field ignoring unrecognized
 properties if they are declared before the last recognized
 properties in JSON
 + #4718: Should not fail on trying to serialize
 'java.time.DateTimeException'
 + #4724: Deserialization behavior change with Records,
 '@JsonCreator' and '@JsonValue' between 2.17 and 2.18
 + #4727: Eclipse having issues due'module-info' class "lost" on
 2.18.0 jars
 + #4741: When 'Include.NON_DEFAULT' setting is used on POJO,
 empty values are not included in json if default is 'null'
 + #4749: Fixed a problem with
 'StdDelegatingSerializer#serializeWithType' looking up the
 serializer with the wrong argument
 * Changes of 2.18.0
 + #562: Allow '@JsonAnySetter' to flow through Creators
 + #806: Problem with 'NamingStrategy', creator methods with
 implicit names
 + #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and
 field level '@JsonProperty'
 + #3120: Return 'ListIterator' from 'ArrayNode.elements()'
 + #3241: 'constructorDetector' seems to invalidate
 'defaultSetterInfo' for nullability
 + #3439: Java Record '@JsonAnySetter' value is null after
 deserialization
 + #4085: '@JsonView' does not work on class-level for records
 + #4119: Exception when deserialization uses a record with a
 constructor property with 'access=READ_ONLY'
 + #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't
 work for beans with Creator methods
 + #4407: 'null' type id handling does not work with
 'writeTypePrefix()'
 + #4452: '@JsonProperty' not serializing field names properly on
 '@JsonCreator' in Record
 + #4453: Allow JSON Integer to deserialize into a single-arg
 constructor of parameter type 'double'
 + #4456: Rework locking in 'DeserializerCache'
 + #4458: Rework synchronized block from 'BeanDeserializerBase'
 + #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'
 method is not called on the serializer
 + #4472: Rework synchronized block in 'TypeDeserializerBase'
 + #4483: Remove 'final' on method BeanSerializer.serialize()
 + #4515: Rewrite Bean Property Introspection logic in Jackson
 2.x
 + #4545: Unexpected deserialization behavior with
 '@JsonCreator', '@JsonProperty' and javac '-parameters'
 + #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper
 .canSerialize()'
 + #4580: Add 'MapperFeature
 .SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator
 properties' declaration order for sorting
 + #4584: Provide extension point for detecting "primary"
 Constructor for Kotlin (and similar) data classes
 + #4602: Possible wrong use of _arrayDelegateDeserializer in
 BeanDeserializerBase::deserializeFromObjectUsingNonDefault()
 + #4617: Record property serialization order not preserved
 + #4626: '@JsonIgnore' on Record property ignored for
 deserialization, if there is getter override
 + #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'
 ignored when serializing Records, if there is getter override
 + #4634: '@JsonAnySetter' not working when annotated on both
 constructor parameter & field
 + #4678: Java records don't serialize with 'MapperFeature
 .REQUIRE_SETTERS_FOR_GETTERS'
 + #4688: Should allow deserializing with no-arg
 '@JsonCreator(mode = DELEGATING)'
 + #4694: Deserializing 'BigDecimal' with large number of
 decimals result in incorrect value
 + #4699: Add extra 'writeNumber()' method in 'TokenBuffer'
 + #4709: Add 'JacksonCollectors' with 'toArrayNode()'
 implementation
 + Fix #5962: Case-insensitive deserialization may use wrong
 @JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-1124=1

Package List:

- openSUSE Leap 16.0:

  jackson-annotations-2.18.8-160000.1.1
  jackson-annotations-javadoc-2.18.8-160000.1.1
  jackson-core-2.18.8-160000.1.1
  jackson-core-javadoc-2.18.8-160000.1.1
  jackson-databind-2.18.8-160000.1.1
  jackson-databind-javadoc-2.18.8-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-54512.html
  * https://www.suse.com/security/cve/CVE-2026-54513.html
  * https://www.suse.com/security/cve/CVE-2026-54514.html
  * https://www.suse.com/security/cve/CVE-2026-54515.html