AnnJoy23 opened a new pull request, #6886:
URL: https://github.com/apache/incubator-kie/pull/6886
## Summary
Fixes **CVE-2026-59889** (CVSS 6.5, Medium) — `jackson-databind`
`@JsonUnwrapped`/`@JsonView` view bypass.
## Root Cause
`spring-boot-dependencies:4.0.7` imports `tools.jackson:jackson-bom:3.1.4`
which resolves `jackson-databind:3.1.4` across the Spring Boot transitive tree.
Dependency path (INTRA-TRANSITIVE):
```
spring-boot-dependencies:4.0.7
└─ tools.jackson:jackson-bom:3.1.4
└─ [drools|jbpm|kie-addons]-spring-boot-starter
→ spring-boot-starter-web → spring-boot-starter-jackson
→ spring-boot-jackson → jackson-databind:3.1.4 ←
CVE-2026-59889
```
## Fix
Import `tools.jackson:jackson-bom:3.1.5` as the first BOM entry in
`springboot/bom/pom.xml` before `spring-boot-dependencies`. Maven
first-declaration-wins ensures this overrides `jackson-bom:3.1.4` throughout
the transitive tree.
**File changed:** `springboot/bom/pom.xml`
## Verification
`mvn help:effective-pom -pl springboot/bom` confirms
`tools.jackson.core:jackson-databind = 3.1.5` ✓
## TODO
Remove force-pin once `spring-boot-dependencies` upgrades its
`jackson-bom.version` to `>= 3.1.5`.
## References
- https://nvd.nist.gov/vuln/detail/CVE-2026-59889
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
