Skip to content

Jackson Release 2.22.4

Jump to bottom
Tatu Saloranta edited this page Oct 17, 2026 · 30 revisions

Patch version of 2.22, released on October 17, 2026.

Following fixes are included in this patch release.

Changes, core

Streaming

  • #1683: JSON\uXXXX escape accepts lone surrogates in field names for ReaderBasedJsonParser
  • #1730: Make FilteringGeneratorDelegate handle embedded objects, typed arrays and raw/binary values consistently
  • #1742: Non-blocking parser returns NOT_AVAILABLE with needMoreInput() false when a feed ends inside an escaped surrogate pair in a property name
  • #1744: UTF8DataInputJsonParser fails on JSON-escaped surrogate pairs in property names
  • #1746: Non-blocking parser rejects leading-decimal-point numbers after , or : with ALLOW_LEADING_DECIMAL_POINT_FOR_NUMBERS
  • #1750: ALLOW_UNESCAPED_CONTROL_CHARS ignored for single-quoted string values in UTF-8 byte parsers
  • #1756: Non-blocking parser does not decode multi-byte UTF-8 character after backslash escape

Databind

  • #6206: Report cycle through @JsonValue accessor as DatabindException
  • #6227: BeanDescription.findProperties() is not thread-safe when called concurrently on the same (shared/cached) instance
  • #6249: Avoid NPE when parser reports VALUE_STRING with null text
  • #6287: Validate type parameters and array element types of type ids [CVE-2026-110879]

Changes, dataformats

Avro

  • #816: Validate union index in UnionReader.nextToken()
  • #819: Avro bytes value allocated to declared length before checking available content [CVE-2026-104015]
  • #852: skipMap() / skipArray() on Decoder passed to @AvroEncode CustomEncoding misreads data

CBOR

  • #821: CBORParser.TagList should grow its backing array geometrically [CVE-2026-106554]

Ion

  • #818: Report corrupt Ion content for String/Symbol value without text

Protobuf

  • #817: Improve length validation for length-prefixed values in ProtobufParser [CVE-2026-104016][CVE-2026-104017][CVE-2026-110747]

Smile

  • #825: Non-blocking Smile parser should validate raw binary length and not pre-allocate full buffer [CVE-2026-104895]
  • #830: Non-blocking Smile parser silently drops truncated root-level value at end-of-input
  • #833: Non-blocking _decodeShortUnicodeText() reads past declared String length on truncated UTF-8 sequence

TOML

  • #726: Fix TomlGenerator.writeString(char[],int,int) index bug when escaping needed

Jakarta-RS Providers

  • #76: Widen jakarta.ws.rs OSGi import range for Jakarta EE 11 / Jakarta REST 4.x

Clone this wiki locally