Upgrade jackson-databind 2.21.1 to 2.22.0 due to multiple 3rd party vulnerabilities CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-50193

Current Situation

Currently JS7 components Controller, Agent and JOC ship with jackson-databind version 2.19.0 (JS7 2.7.8) and 2.21.1(JS7 2.8.3) respectively which are both affected by a number of 3rd party vulnerabilities.

• CVE-2026-54512
  • Impact: LOW
  • this vulnerability affects applications that allow untrusted JSON, which does not apply with to software
  • example: allowed types are checked, but nested objects are not
    • Type ArrayList is allowed
    • ArrayList<HarmfulObject>
      • ArrayList is checked
      • HarmfulObject is never validated
• CVE-2026-54513
  • Impact: LOW
  • this vulnerability affects applications that allow untrusted JSON, which does not apply to software
    • example forbidden objects are checked, arrays of the same object are not
    • HarmfulObject is forbidden
    • HarmfulObject is checked and forbidden
    • HarmfulObject[] in not checked, rules for arrays apply without checking the object type 
• CVE-2026-54514
  • Impact: LOW
  • this vlunerability affects applications that binds untrusted JSON into a type containing an InetSocketAddress, which does not apply to our software
• CVE-2026-54515
  • Impact: LOW
  • this vulnerability affects applications that both enable case-insensitive matching and rely on per-property @JsonIgnoreProperties
• CVE-2026-54516
  • Impact: LOW
  • this vulnerability affects applications that POJOs combining a renamed getter with an ignored setter, which does not apply to our software
• CVE-2026-54517
  • Impact: LOW
  • this vulnerability affects applications that make use of view-restricted setterless collection/map properties, that can be written from untrusted JSON  despite @JsonView gating, which does not apply to our software
• CVE-2026-54518
  • Impact: LOW
  • this vulnerability affects applications that make use of view-restricted unwrapped creator parameters that can be set from untrusted input where @JsonView is used as a write-side authorization boundary, which does not apply to our software
• CVE-2026-50193
  • Impact: LOW
  • Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service:

1. 1. 1. Reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree())
      2. Writes out same (or modifided) node using JsonNode.toString()
   • this does not apply to our software as our software does not make use of methods ObjectMapper.readTree() or JsonNode.toString()

Desired Behavior

JS7 components Controller, Agent and JOC should use jackson-databind version 2.22.0 which solves all vulnerabilities mentioned above.