Commit 050e8e4
Upgrade Jackson to 2.21.1 to fix async parser DoS vulnerability
Fixes Dependabot alert #1 (GHSA-72hv-8253-57qq): jackson-core async
parser bypasses maxNumberLength constraint, allowing DoS via excessive
memory/CPU consumption with arbitrarily long numbers.
Upgrades:
- jackson-databind: 2.20.1 -> 2.21.1
- jackson-annotations: 2.20 -> 2.21
- jackson-datatype-jsr310: 2.20.1 -> 2.21.1
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>1 parent 6cfbe4f commit 050e8e4
1 file changed
+3
-3
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
49 | 49 | | |
50 | 50 | | |
51 | 51 | | |
52 | | - | |
| 52 | + | |
53 | 53 | | |
54 | 54 | | |
55 | 55 | | |
56 | 56 | | |
57 | | - | |
| 57 | + | |
58 | 58 | | |
59 | 59 | | |
60 | 60 | | |
61 | 61 | | |
62 | | - | |
| 62 | + | |
63 | 63 | | |
64 | 64 | | |
65 | 65 | | |
| |||
0 commit comments