Jackson Release 2.21.7

Patch version of 2.21, released on September 21, 2026.

Following fixes are included in this patch release.

• #1649: Optimize NumberInput.looksLikeValidNumber [CVE-2026-89407]
• #1668: WriterBasedJsonGenerator throws ArrayIndexOutOfBoundsException when a zero-length custom escape ends exactly at the output buffer boundary
• #1698: Honor maxErrorTokenLength in UTF8DataInputJsonParser [CVE-2026-89425]
• #1713: UTF32Reader corrupts or drops the low surrogate when a supplementary character splits across a read() boundary

• #6185: Unresolved IPv6 InetSocketAddress serialized without brackets, losing port on round-trip
• #6203: Prevent unbounded growth of type id cache in TypeDeserializer [CVE-2026-91776]
• #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers [CVE-2026-91777]
• #6205: Avoid quadratic forward-reference resolution in ObjectArrayDeserializer

• #785: Support StreamReadConstraints.maxDocumentLength and maxTokenCount in Avro parser

• #803: Support StreamReadConstraints.maxNestingDepth in Ion parser
• #805: Support StreamReadConstraints.maxDocumentLength in Ion parser

• #738: Support StreamReadConstraints.maxDocumentLength() in Properties parser

• #776: Fix writeString(char[],int,int) writing enum values twice
• #783: Support StreamReadConstraints.maxDocumentLength in ProtobufParser

• #761: Async Smile parser misses #312 NUL-padding: short property name collides with NUL-prefixed longer one
• #770: Fix async parser decoding of short ASCII values split across input feeds

• #723: Fix TomlGenerator.writeNumber(short) writing an extra empty line
• #736: Support StreamReadConstraints maxNameLength/maxDocumentLength in TOML parser

• #737: Support StreamReadConstraints maxNameLength/maxDocumentLength in YAML parser