Skip to content

Jackson Release 3.2.2

Jump to bottom
Tatu Saloranta edited this page Aug 8, 2026 · 32 revisions

Patch version of 3.2, under development as of July 2026.

Following fixes will be included in this patch release.

Changes, core

Streaming

  • #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
  • #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser [CVE-2026-68498]

Databind

  • #6096: Honor @JsonView in BeanAsArrayDeserializer update path
  • #6099: Resolve classes without initialization in TypeFactory.findClass()
  • #6101: @JsonInclude(NON_EMPTY, content=CUSTOM) does not omit a Map property after all entries are filtered
  • #6109: Mark built-in JDK 8 handlers as Jackson standard implementations
  • #6115: Honor @JsonIgnoreProperties before any-setter on more deser paths
  • #6116: Reject non-ASCII digits in InetAddress literal validation
  • #6127: Add StreamReadConstraints number len constraint to GregorianCalendar and Duration [CVE-2026-68497]
  • #6129: Limit the supported URL schemes for java.nio.file.Path deserialization [CVE-2026-19032]
  • #6133: Limit number sizes allowed in java.time.Instant deserializer
  • #6137: DefaultCacheProvider.Builder does not preserve default cache sizes for unspecified values

Changes, dataformats

CBOR

  • #725: Ensure maxNameLength limit enforced for CBOR parser [CVE-2026-68495]
  • #727: CBORParser.nextFieldName(SerializableString) confuses 5-bit length marker 23 with 24 ("1-byte length follows")
  • #728: CBORParser.nextFieldName(SerializableString) consumes Object entry slot twice on fast-path miss, truncating definite-length Objects
  • #735: "stringref" property-name paths pass 5-bit length marker instead of actual length to shouldReferenceString()
  • #736: Long Object property names added to "stringref" reference table twice
  • #742: Use ArrayDeque instead of Stack in CBORParser

Protobuf

  • #708: Proto3 fields without label fail to parse
  • #714: Packed repeated field fails to decode when array spans an input buffer reload
  • #715: ProtobufGenerator._reportWrongWireType() always reports string, ignoring actual type

Smile

  • #720: SmileGenerator writes past output buffer (ArrayIndexOutOfBoundsException) for very long Strings due to int overflow in maxLen
  • #726: Ensure maxNameLength limit enforced for Smile parser [CVE-2026-68496]

TOML

  • #702: Expand TOML dotted key nesting checks

XML

  • #884: java.lang.NullPointerException: Cannot invoke "tools.jackson.databind.introspect.Annotated.getAnnotation(java.lang.Class)" because "ann" is null

YAML

  • #701: ALWAYS_QUOTE_NUMBERS_AS_STRINGS does not quote YAML 1.1 exponent (1e5), hex (0x1F) and underscore (12_34) number forms
  • #707: Should constraint deeply nested YAML merge keys in YAMLAnchorReplayingParser [GHSA-255r-36wv-4qpr]

Changes, Other modules

Blackbird

  • #355: Blackbird silently reverts Optional (reference-type) properties to reflection MethodProperty: Jdk8OptionalDeserializer fails isDefaultDeserializer check

Clone this wiki locally