HeroDevs
Visit NES for Jackson Home Page

Jackson Databind 2.14.x Release Notes

5 versions

Comprehensive release notes and changelog for Jackson Databind 2.14.x, including security patches, bug fixes, and feature updates across all supported versions.

Sep 10, 2026
Latest: 2.14.8
31 Patched Vulnerabilities
VEX Statements

September 2026

2.14.8

Released Sep 10, 2026
CVE-2026-68497
CVE-2026-77310
Full Version: 
2.14.3-jackson-databind-2.14.8

Security Fixes

This release patches the following:

  • CVE-2026-68497: enforce number-length limits when deserializing Duration and XMLGregorianCalendar
  • CVE-2026-77310: disable DNS resolution when deserializing InetAddress

Dependency Upgrades

  • Jackson BOM (NES) 2.14.3-jackson-bom-2.14.8

2.14.7

Released Sep 4, 2026
CVE-2026-19032
CVE-2026-83557
Full Version: 
2.14.3-jackson-databind-2.14.7

Security Fixes

This release patches the following:

  • CVE-2026-19032: restrict URL schemes in java.nio.file.Path deserialization
  • CVE-2026-83557: include java.lang.Comparable in the unsafe base-type denylist

Dependency Upgrades

  • Jackson BOM (NES) 2.14.3-jackson-bom-2.14.7

July 2026

2.14.6

Released Jul 26, 2026
Full Version: 
2.14.3-jackson-databind-2.14.6

Dependency Upgrades

  • Jackson BOM (NES) 2.14.3-jackson-bom-2.14.6

2.14.5

Released Jul 2, 2026
CVE-2026-54512
CVE-2026-54513
CVE-2026-54514
CVE-2026-54515
CVE-2026-54516
1 More
Full Version: 
2.14.3-jackson-databind-2.14.5

Security Fixes

This release patches the following:

  • CVE-2026-54512: validate polymorphic generic type parameters
  • CVE-2026-54513: validate array component subtype in BasicPolymorphicTypeValidator
  • CVE-2026-54514: avoid eager DNS lookup in InetSocketAddress deserialization
  • CVE-2026-54515: case-insensitive deserialization ignores per-property @JsonIgnoreProperties
  • CVE-2026-54516: renamed @JsonIgnore'd setters can deserialize via private fields
  • CVE-2026-54517: apply active @JsonView filter in property-based deserialization

Dependency Updates

  • Jackson BOM (NES) 2.14.3-jackson-bom-2.14.5
  • Jackson Annotations (NES) 2.14.3-jackson-annotations-2.14.5
  • Jackson Core (NES) 2.14.3-jackson-core-2.14.5

June 2026

2.14.4

Released Jun 2, 2026
Full Version: 
2.14.3-jackson-databind-2.14.4

Notes

  • This release originates from the open‑source jackson-databind project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.

Dependency Updates

  • Jackson BOM (NES) 2.14.3-jackson-bom-2.14.4

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.