Repository navigation
Maintenance: Using vulnerable jackson-databind version #2544
Description
Summary
Jackson-Databind is vulnerable to https://www.cve.org/CVERecord?id=CVE-2026-54513
Why is this needed?
Which area does this relate to?
No response
Solution
No response
Acknowledgment
- This request meets Powertools for AWS Lambda (Java) Tenets
- Should this be considered in other Powertools for AWS Lambda languages? i.e. Python, TypeScript
Activity
phipag commentedon Jun 29, 2026
Hey @pascalknupper, thank you reporting this. I am bumping our Jackson version and will make a new release
2.11very soon.phipag commentedon Jul 2, 2026
I created PR #2556
phipag commentedon Jul 2, 2026
Holding the Jackson bump (PR #2556) because 2.22.0 is affected by a newly disclosed vulnerability (CVE-2026-54515 / GHSA-5jmj-h7xm-6q6v) that has no publicly released 2.x fix yet, so we need to wait until 2.22.1 is published.
pascalknupper commentedon Jul 13, 2026
@phipag it seems like 2.22.1 has been released https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.22.1. I think this can be unblocked, I already created a proposal for the update. Thanks a lot for your work :)
powertools-for-aws-oss-automation commentedon Jul 15, 2026
Warning
This issue is now closed. Please be mindful that future comments are hard for our team to see.
If you need more assistance, please either reopen the issue, or open a new issue referencing this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.
barnabycollins commentedon Jul 16, 2026
Hi @phipag - we're really keen to get the updated version of databind into our repositories. Do you know when a new release of powertools is likely?
phipag commentedon Jul 21, 2026
Hey @barnabycollins, I am looking to do another release next week.
pascalknupper commentedon Aug 26, 2026
Hi @phipag is there any progress on a new release?