Security update for jackson-annotations, jackson-core, jackson-databind

The update for jackson-annotations, jackson-core, and jackson-databind fixes several vulnerabilities: CVE-2026-18401 and CVE-2026-68494 address number length constraint bypasses in asynchronous parsers that could lead to processing time issues; CVE-2026-19032 restricts URI schemes in java.nio.file.Path deserialization to prevent unsafe resolution of attacker-supplied URIs; CVE-2026-68497 mitigates the ability for unauthenticated attackers to submit large requests; CVE-2026-68498 enforces maxNameLength incrementally to prevent bypass; CVE-2026-83557 adds java.lang.Comparable to unsafe polymorphic base types to prevent arbitrary deserialization; CVE-2026-89425 limits unbounded StringBuilder growth during malformed token processing to prevent denial of service; CVE-2026-91776 prevents unbounded cache growth from attacker-supplied type IDs; and CVE-2026-91777 optimizes forward-reference completion to avoid quadratic CPU usage. These fixes are included in version 2.18.11 of the respective libraries.

The vulnerabilities could allow attackers to bypass input length constraints, causing excessive processing time or denial of service conditions. Unsafe deserialization of attacker-controlled data could lead to arbitrary code execution or resource exhaustion. Unbounded cache growth and inefficient processing could degrade application performance or cause crashes. The ability to submit large requests without authentication increases the risk of denial of service attacks.

A fixed version 2.18.11 of jackson-annotations, jackson-core, and jackson-databind is available and should be applied to remediate these vulnerabilities. Users should upgrade to this version to ensure all listed issues are addressed. No additional mitigation steps are indicated beyond applying the update.