HeroDevs
Visit NES for Jackson Home Page

Jackson Databind 2.13.x Release Notes

3 versions

Comprehensive release notes and changelog for Jackson Databind 2.13.x, including security patches, bug fixes, and feature updates across all supported versions.

Jul 26, 2026
Latest: 2.13.9
19 Patched Vulnerabilities
VEX Statements

July 2026

2.13.9

Released Jul 26, 2026
Full Version: 
2.13.5-jackson-databind-2.13.9

Dependency Upgrades

  • Jackson BOM (NES) 2.13.5-jackson-bom-2.13.9

2.13.8

Released Jul 2, 2026
CVE-2026-50193
CVE-2026-54512
CVE-2026-54513
CVE-2026-54514
CVE-2026-54515
2 More
Full Version: 
2.13.5-jackson-databind-2.13.8

Bug Fixes

This release patches the following:

  • CVE-2026-50193: avoid recursive JsonNode string serialization
  • CVE-2026-54512: validate polymorphic generic type parameters
  • CVE-2026-54513: validate array component subtype in BasicPolymorphicTypeValidator
  • CVE-2026-54514: avoid eager DNS lookup in InetSocketAddress deserialization
  • CVE-2026-54515: case-insensitive deserialization ignores per-property @JsonIgnoreProperties
  • CVE-2026-54516: renamed @JsonIgnore'd setters can deserialize via private fields
  • CVE-2026-54517: apply active @JsonView filter in property-based deserialization

Dependency Updates

  • Jackson BOM (NES) 2.13.5-jackson-bom-2.13.8
  • Jackson Annotations (NES) 2.13.5-jackson-annotations-2.13.8
  • Jackson Core (NES) 2.13.5-jackson-core-2.13.8

September 2025

2.13.6

Released Sep 25, 2025
Full Version: 
2.13.5-jackson-databind-2.13.6

Notes

  • This release originates from the open‑source jackson-databind project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.

Dependency Updates

  • Jackson BOM (NES) 2.13.5-jackson-bom-2.13.6

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.