fix(deps): vuln minor: com.fasterxml.jackson.core:jackson-core, com.fasterxml.jackson.core:jackson-databind [pom.xml]

[gh-worker-campaigns-3e9aa4]

Warning

Shotclock auto-merge countdown

This PR may be automatically approved and merged on or after October 26, 2026 (UTC) if nobody acts and all required Shotclock eligibility checks pass.

To stop Shotclock, comment or review this PR, request changes, push a commit, or close the PR. Converting it to draft pauses automation.

Summary: High-severity security update — 2 packages upgraded (MINOR changes included)

Manifests changed:

• pom.xml (maven)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
com.fasterxml.jackson.core:jackson-databind	2.20.1	2.22.3	minor	Direct	10 HIGH, 12 MEDIUM
com.fasterxml.jackson.core:jackson-core	2.20.1	2.22.3	minor	Direct	6 HIGH, 2 MEDIUM

---

Security Details

🚨 Critical & High Severity (16 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
com.fasterxml.jackson.core:jackson-core	GHSA-p6pp-m3f8-5c89	HIGH	jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()	2.20.1	2.18.11	-
com.fasterxml.jackson.core:jackson-core	CVE-2026-89407	HIGH	jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS	2.20.1	-	-
com.fasterxml.jackson.core:jackson-core	GHSA-7hhh-6rmp-j9qf	HIGH	jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)	2.20.1	2.21.7	-
com.fasterxml.jackson.core:jackson-core	CVE-2026-89425	HIGH	jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth	2.20.1	-	-
com.fasterxml.jackson.core:jackson-core	GHSA-r7wm-3cxj-wff9	HIGH	jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)	2.20.1	2.18.8	-
com.fasterxml.jackson.core:jackson-core	CVE-2026-68494	HIGH	jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-91777	HIGH	jackson-databind: quadratic forward-reference completion in Collection and Map deserializers	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-cxp5-3px4-pw24	HIGH	jackson-databind quadratic forward-reference completion	2.20.1	2.21.7	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54512	HIGH	jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-j3rv-43j4-c7qm	HIGH	jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation	2.20.1	2.18.8	-
com.fasterxml.jackson.core:jackson-databind	GHSA-wv8q-qhhj-9h54	HIGH	jackson-databind retains every unknown raw type ID	2.20.1	2.18.11	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-91776	HIGH	jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54513	HIGH	jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-rmj7-2vxq-3g9f	HIGH	jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)	2.20.1	2.18.8	-
com.fasterxml.jackson.core:jackson-databind	GHSA-q4xh-88c3-wmh7	HIGH	jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS	2.20.1	2.18.10	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-68497	HIGH	jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service	2.20.1	-	-

ℹ️ Other Vulnerabilities (14)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
com.fasterxml.jackson.core:jackson-core	CVE-2026-18401	MODERATE	jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service	2.20.1	-	-
com.fasterxml.jackson.core:jackson-core	GHSA-72hv-8253-57qq	MODERATE	jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition	2.20.1	2.21.1	-
com.fasterxml.jackson.core:jackson-databind	GHSA-5jmj-h7xm-6q6v	MODERATE	jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties	2.20.1	3.1.4	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-83557	MODERATE	jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-gx83-3vf8-gh7j	MODERATE	jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)	2.20.1	2.18.10	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-59888	MODERATE	jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-vvgp-rfg2-7rr6	MODERATE	jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization	2.20.1	2.18.9	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-77310	MODERATE	jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-3pjw-73gf-8qr5	MODERATE	jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy	2.20.1	2.18.8	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54515	MODERATE	jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-wjgm-6hv5-3cvf	MODERATE	jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution	2.20.1	2.18.10	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-19032	MODERATE	jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54514	MODERATE	jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-hgj6-7826-r7m5	MODERATE	jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)	2.20.1	2.18.8	-

⚠️ Dependencies that have Reached EOL (2)

Dependency	Unsafe Version	EOL Date	New Version	Path	Case
com.fasterxml.jackson.core:jackson-core	2.20.1	-	2.22.3	pom.xml	-
com.fasterxml.jackson.core:jackson-databind	2.20.1	-	2.22.3	pom.xml	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-10-19T19:16:45Z
• ⬜ CI tests passed
• ⬜ Approved
• ⬜ Merge Started
• ⬜ Merged

➡️ Current phase: CI tests failed. Please fix the failing tests and rerun the workflow, click Workflow Link -> Workflow Starter Link -> Start Workflow