Gergely Harmadás created KAFKA-21004:
----------------------------------------
Summary: [CVE-2026-68497][jackson-databind]
Key: KAFKA-21004
URL: https://issues.apache.org/jira/browse/KAFKA-21004
Project: Kafka
Issue Type: Bug
Reporter: Gergely Harmadás
Assignee: Gergely Harmadás
The Jackson project reports: PolymorphicTypeValidator needs to validate generic
type parameters too BasicPolymorphicTypeValidator setting
allowIfSubTypeIsArray() should validate element type Add java.lang.Comparable
in set of "unsafe" polymorphic base types @JsonView by-passed for
@JsonUnwrapped Field/Setter properties @JsonView by-passed for some
"setterless" creator properties @JsonView by-passed for unwrapped creator
parameters Honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties
Renamed @JsonIgnore'd setters can deserialize via private fields @JsonIgnore on
Record property ignored with PropertyNamingStrategy Case-insensitive
deserialization may use wrong @JsonIgnoreProperties Do not allow DNS resolution
when deserializing InetAddress Improve InetSocketAddress deserialization Limit
the supported URL schemes for java.nio.file.Path deserialization Add
StreamReadConstraints number len constraint to
javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration
*NVD URL :* [https://nvd.nist.gov/vuln/detail/cve-2026-68497] (not yet in the
database)
[https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.6] contains the
fix
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
