Skip to content

Commit 050e8e4

Browse files
brunoborgesCopilot
andcommitted
Upgrade Jackson to 2.21.1 to fix async parser DoS vulnerability
Fixes Dependabot alert #1 (GHSA-72hv-8253-57qq): jackson-core async parser bypasses maxNumberLength constraint, allowing DoS via excessive memory/CPU consumption with arbitrarily long numbers. Upgrades: - jackson-databind: 2.20.1 -> 2.21.1 - jackson-annotations: 2.20 -> 2.21 - jackson-datatype-jsr310: 2.20.1 -> 2.21.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 6cfbe4f commit 050e8e4

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

pom.xml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,17 +49,17 @@
4949
<dependency>
5050
<groupId>com.fasterxml.jackson.core</groupId>
5151
<artifactId>jackson-databind</artifactId>
52-
<version>2.20.1</version>
52+
<version>2.21.1</version>
5353
</dependency>
5454
<dependency>
5555
<groupId>com.fasterxml.jackson.core</groupId>
5656
<artifactId>jackson-annotations</artifactId>
57-
<version>2.20</version>
57+
<version>2.21</version>
5858
</dependency>
5959
<dependency>
6060
<groupId>com.fasterxml.jackson.datatype</groupId>
6161
<artifactId>jackson-datatype-jsr310</artifactId>
62-
<version>2.20.1</version>
62+
<version>2.21.1</version>
6363
</dependency>
6464

6565
<!-- SpotBugs annotations for suppressing warnings -->

0 commit comments

Comments
 (0)