Merge pull request #631 from IABTechLab/syw-UID2-7364-upgrade-jackson-databind

UID2-7364: Upgrade jackson-databind 2.14.2 -> 2.19.0 (CVE-2026-54512 / CVE-2026-54513)

Author: sophia-chen-ttd

.trivyignore

@@ -5,3 +5,8 @@
 # jackson-core async parser DoS - not exploitable, services only use synchronous ObjectMapper API
 # See: UID2-6670
 GHSA-72hv-8253-57qq exp:2026-09-01
+
+# jackson-databind data-binding vulnerability - no upstream fix released yet (fix targets: 2.18.8, 2.21.4, 3.1.4)
+# See: UID2-7364
+CVE-2026-54512 exp:2026-07-25
+CVE-2026-54513 exp:2026-07-25

pom.xml

@@ -206,10 +206,15 @@
             <artifactId>cbor</artifactId>
             <version>0.9</version>
         </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+            <version>2.19.0</version>
+        </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.14.2</version>
+            <version>2.19.0</version>
         </dependency>
         <dependency>
             <groupId>org.projectlombok</groupId>