Jackson Release 3.2.3

Patch version of 3.2, released on September 21, 2026.

Following fixes are included in this patch release.

• #1668: WriterBasedJsonGenerator throws ArrayIndexOutOfBoundsException when a zero-length custom escape ends exactly at the output buffer boundary
• #1670: Fix willInternPropertyNames() when canonicalization is disabled
• #1673: Fix AIOOBE in readString(Writer) at output buffer boundary
• #1692: Fix lost output for non-UTF-8 generators, and close File/Path targets on failed construction
• #1693: Close streams opened for File/Path sources when parser construction fails
• #1694: Release IOContext when parser/generator construction fails
• #1695: Release resources in UTF8Writer.close() when flush of pending content fails
• #1698: Honor maxErrorTokenLength in UTF8DataInputJsonParser [CVE-2026-89425]
• #1703: Validate name length in UTF8DataInputJsonParser before quad buffer growth
• #1713: UTF32Reader corrupts or drops the low surrogate when a supplementary character splits across a read() boundary
• #1718: Source opened for File/Path parser leaks if decorated stream close() fails on failed construction

• #6157: @JsonIncludeProperties not honored for Throwable types with @JsonAnySetter
• #6174: Honor @JsonView in ThrowableDeserializer.deserializeFromObject()
• #6179: Validate number length when coercing String to double
• #6182: StdDateFormat.<clinit> degrades JIT compilation of UTF8JsonGenerator._writeStringSegment
• #6185: Unresolved IPv6 InetSocketAddress serialized without brackets, losing port on round-trip
• #6203: Prevent unbounded growth of type id cache in TypeDeserializer [CVE-2026-91776]
• #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers [CVE-2026-91777]
• #6205: Avoid quadratic forward-reference resolution in ObjectArrayDeserializer
• #6214: DecimalNode to BigInteger conversion no longer guarded by StreamReadConstraints.validateBigIntegerScale()
• #6223: Avoid quadratic Object Id rebinding for Builder- and delegate-based values

• #745: Fix Avro bugs
• #785: Support StreamReadConstraints.maxDocumentLength and maxTokenCount in Avro parser

• #800: Upgrade ion-java dependency to 1.12.1
• #803: Support StreamReadConstraints.maxNestingDepth in Ion parser
• #805: Support StreamReadConstraints.maxDocumentLength in Ion parser

• #738: Support StreamReadConstraints.maxDocumentLength() in Properties parser

• #776: Fix writeString(char[],int,int) writing enum values twice
• #783: Support StreamReadConstraints.maxDocumentLength in ProtobufParser

• #761: Async Smile parser misses #312 NUL-padding: short property name collides with NUL-prefixed longer one
• #770: Fix async parser decoding of short ASCII values split across input feeds

• #723: Fix TomlGenerator.writeNumber(short) writing an extra empty line
• #736: Support StreamReadConstraints maxNameLength/maxDocumentLength in TOML parser

• #894: Read stream to end for negative length in writeBinary(InputStream)
• #911: Verify Stax factory type before instantiating in XmlFactory.readResolve()
• #914: Apply format features set via XmlFactoryBuilder to XmlFactory
• #915: Retain constraints and stream features in XmlFactory.readResolve()

• #737: Support StreamReadConstraints maxNameLength/maxDocumentLength in YAML parser