fix(deps): vuln minor: com.fasterxml.jackson.core:jackson-core, com.fasterxml.jackson.core:jackson-databind [pom.xml]

[gh-worker-campaigns-3e9aa4]

Warning

Shotclock auto-merge countdown

This PR may be automatically approved and merged on or after October 5, 2026 (UTC) if nobody acts and all required Shotclock eligibility checks pass.

To stop Shotclock, comment or review this PR, request changes, push a commit, or close the PR. Converting it to draft pauses automation.

Summary: High-severity security update — 2 packages upgraded (MINOR changes included)

Manifests changed:

• pom.xml (maven)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
com.fasterxml.jackson.core:jackson-databind	2.20.1	2.22.3	minor	Direct	4 HIGH, 6 MEDIUM
com.fasterxml.jackson.core:jackson-core	2.20.1	2.22.3	minor	Direct	1 HIGH, 2 MEDIUM

---

Security Details

🚨 Critical & High Severity (5 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
com.fasterxml.jackson.core:jackson-core	GHSA-r7wm-3cxj-wff9	HIGH	jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)	2.20.1	2.18.8	-
com.fasterxml.jackson.core:jackson-databind	GHSA-rmj7-2vxq-3g9f	HIGH	jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)	2.20.1	2.18.8	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54512	HIGH	jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-j3rv-43j4-c7qm	HIGH	jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation	2.20.1	2.18.8	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54513	HIGH	jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)	2.20.1	-	-

ℹ️ Other Vulnerabilities (8)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
com.fasterxml.jackson.core:jackson-core	GHSA-72hv-8253-57qq	MODERATE	jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition	2.20.1	2.21.1	-
com.fasterxml.jackson.core:jackson-core	CVE-2026-18401	MODERATE	jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-hgj6-7826-r7m5	MODERATE	jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)	2.20.1	2.18.8	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54515	MODERATE	jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-5jmj-h7xm-6q6v	MODERATE	jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties	2.20.1	3.1.4	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54514	MODERATE	jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)	2.20.1	-	-
com.fasterxml.jackson.core:jackson-databind	GHSA-3pjw-73gf-8qr5	MODERATE	jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy	2.20.1	2.18.8	-
com.fasterxml.jackson.core:jackson-databind	CVE-2026-59888	MODERATE	jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy	2.20.1	-	-

⚠️ Dependencies that have Reached EOL (2)

Dependency	Unsafe Version	EOL Date	New Version	Path	Case
com.fasterxml.jackson.core:jackson-core	2.20.1	-	2.22.3	pom.xml	-
com.fasterxml.jackson.core:jackson-databind	2.20.1	-	2.22.3	pom.xml	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-10-18T14:09:57Z
• ⬜ CI tests passed
• ⬜ Approved
• ⬜ Merge Started
• ⬜ Merged

➡️ Current phase: CI tests failed. Please fix the failing tests and rerun the workflow, click Workflow Link -> Workflow Starter Link -> Start Workflow

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with master — rebased onto 2e46cfc.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[datadog-prod-us1-3]

 

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

Ensure labels | changelog

View more details · View in GitHub Actions

Run Tests | test / test (8, ubuntu-latest)

View more details · View in GitHub Actions

⚠️ Warnings

🧪 4 Tests failed in 1 job

Run Tests | test — ❌ 4 tests failed

View more details · View in GitHub Actions

❌ testIsIaCDisabledByDefault from com.datadog.api.client.ApiClientTest  

Could not initialize class com.datadog.api.client.JSON

❌ testSetIsIaCFalseRemovesManagedByHeader from com.datadog.api.client.ApiClientTest  

Could not initialize class com.datadog.api.client.JSON

❌ testSetIsIaCIsPerClientInstance from com.datadog.api.client.ApiClientTest  

Could not initialize class com.datadog.api.client.JSON

❌ testSetIsIaCTrueAddsManagedByHeaderToDefaultHeaders from com.datadog.api.client.ApiClientTest  

Could not initialize class com.datadog.api.client.JSON

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🔄 Datadog retried 4 tests - 0 passed on retry

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: b3c7f96 | Docs | View more details | Give us feedback!}

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with master — rebased onto c7c8ca7.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}