This is an automated email from the ASF dual-hosted git repository.
yesamer pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new 08c76b5c965 [NO-ISSUE]: Fix Jackson-databind 3.1.4 → 3.1.5 (#6886)
08c76b5c965 is described below
commit 08c76b5c9655ad900fcf5e564d8d3e274ad248ff
Author: ANN JOY <[email protected]>
AuthorDate: Mon Aug 17 18:25:15 2026 +0530
[NO-ISSUE]: Fix Jackson-databind 3.1.4 → 3.1.5 (#6886)
* fix(CVE-2026-59889): pin jackson-bom to 3.1.5 in kogito-spring-boot-bom
spring-boot-dependencies:4.0.7 imports tools.jackson:jackson-bom:3.1.4
which carries the vulnerable jackson-databind:3.1.4.
Importing jackson-bom:3.1.5 before spring-boot-dependencies overrides
the transitive version for all spring-boot-* carriers.
Remove this pin once spring-boot-dependencies imports jackson-bom >= 3.1.5.
* chore: empty commit to trigger CI
* chore: empty commit
* fix(cve): pin jackson-databind to 3.1.5 instead of full jackson-bom import
CVE-2026-59889: replace the tools.jackson:jackson-bom BOM import with a
targeted jackson-databind direct dependency pin at 3.1.5 to override the
vulnerable 3.1.4 carried by spring-boot-dependencies:4.0.7. Avoids pulling
in the full jackson-bom and pins only the affected artifact.
---
kogito-springboot/bom/pom.xml | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/kogito-springboot/bom/pom.xml b/kogito-springboot/bom/pom.xml
index 3e131f7735d..80a5a7456eb 100644
--- a/kogito-springboot/bom/pom.xml
+++ b/kogito-springboot/bom/pom.xml
@@ -52,9 +52,18 @@
Override the version property inherited from kie-parent to 2.26.1
(minimum 2.25.5).
https://logging.apache.org/security.html#CVE-2026-49844 -->
<version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
+ <!-- CVE-2026-59889: force-pin jackson-databind to 3.1.5.
+ spring-boot-dependencies:4.0.7 carries the vulnerable
jackson-databind:3.1.4.
+ Remove this pin once spring-boot-dependencies imports
jackson-databind >= 3.1.5. -->
+ <version.tools.jackson.core>3.1.5</version.tools.jackson.core>
</properties>
<dependencyManagement>
<dependencies>
+ <dependency>
+ <groupId>tools.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ <version>${version.tools.jackson.core}</version>
+ </dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
