[
https://issues.apache.org/jira/browse/KAFKA-21004?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Chia-Ping Tsai updated KAFKA-21004:
-----------------------------------
Fix Version/s: 4.4.0
4.2.2
4.3.2
> [CVE-2026-68497][jackson-databind]
> ----------------------------------
>
> Key: KAFKA-21004
> URL: https://issues.apache.org/jira/browse/KAFKA-21004
> Project: Kafka
> Issue Type: Bug
> Reporter: Gergely Harmadás
> Assignee: Gergely Harmadás
> Priority: Major
> Fix For: 4.4.0, 4.2.2, 4.3.2
>
>
> The Jackson project reports: PolymorphicTypeValidator needs to validate
> generic type parameters too BasicPolymorphicTypeValidator setting
> allowIfSubTypeIsArray() should validate element type Add java.lang.Comparable
> in set of "unsafe" polymorphic base types @JsonView by-passed for
> @JsonUnwrapped Field/Setter properties @JsonView by-passed for some
> "setterless" creator properties @JsonView by-passed for unwrapped creator
> parameters Honor @JsonView for external-type-id (EXTERNAL_PROPERTY)
> properties Renamed @JsonIgnore'd setters can deserialize via private fields
> @JsonIgnore on Record property ignored with PropertyNamingStrategy
> Case-insensitive deserialization may use wrong @JsonIgnoreProperties Do not
> allow DNS resolution when deserializing InetAddress Improve InetSocketAddress
> deserialization Limit the supported URL schemes for java.nio.file.Path
> deserialization Add StreamReadConstraints number len constraint to
> javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration
> *NVD URL :* [https://nvd.nist.gov/vuln/detail/cve-2026-68497] (not yet in the
> database)
> [https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.6] contains
> the fix
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
