[
https://issues.apache.org/jira/browse/KAFKA-21004?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Chia-Ping Tsai resolved KAFKA-21004.
------------------------------------
Resolution: Fixed
trunk:
https://github.com/apache/kafka/commit/5aa50d8981ccd0138518cf6b4d097f7a6734ba85
4.4:
[https://github.com/apache/kafka/commit/3225ce490ef02f6c6c957db3b5683b96a973c8ed]
4.3:
[https://github.com/apache/kafka/commit/f0a2be3d284464c4c98cff7a669cd8d6f3db8c41]
4.2:
https://github.com/apache/kafka/commit/e3d4f4755deee0674536ab96e4a4c246499a3996
> [CVE-2026-68497][jackson-databind]
> ----------------------------------
>
> Key: KAFKA-21004
> URL: https://issues.apache.org/jira/browse/KAFKA-21004
> Project: Kafka
> Issue Type: Bug
> Reporter: Gergely Harmadás
> Assignee: Gergely Harmadás
> Priority: Major
> Fix For: 4.4.0, 4.2.2, 4.3.2
>
>
> The Jackson project reports: PolymorphicTypeValidator needs to validate
> generic type parameters too BasicPolymorphicTypeValidator setting
> allowIfSubTypeIsArray() should validate element type Add java.lang.Comparable
> in set of "unsafe" polymorphic base types @JsonView by-passed for
> @JsonUnwrapped Field/Setter properties @JsonView by-passed for some
> "setterless" creator properties @JsonView by-passed for unwrapped creator
> parameters Honor @JsonView for external-type-id (EXTERNAL_PROPERTY)
> properties Renamed @JsonIgnore'd setters can deserialize via private fields
> @JsonIgnore on Record property ignored with PropertyNamingStrategy
> Case-insensitive deserialization may use wrong @JsonIgnoreProperties Do not
> allow DNS resolution when deserializing InetAddress Improve InetSocketAddress
> deserialization Limit the supported URL schemes for java.nio.file.Path
> deserialization Add StreamReadConstraints number len constraint to
> javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration
> *NVD URL :* [https://nvd.nist.gov/vuln/detail/cve-2026-68497] (not yet in the
> database)
> [https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.6] contains
> the fix
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
