Description of the patch:
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues
- CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows
arbitrary class instantiation (bsc#1268897).
- CVE-2026-54513: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898).
- CVE-2026-54514: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
- CVE-2026-54515: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
(bsc#1268902).
- document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).
Changes for jackson-annotations:
Changes for jackson-core:
- #1611: Apply number-length validator on streaming integer path
of async parser
- #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints
.getMaxDocumentLength()' set
(bsc#1268603, GHSA-2m67-wjpj-xhg9)
- #1600: Rework 3rd party licenses in jar
- #1602: 'UTF8DataInputJsonParser' needs to enforce
'StreamReadConstraints.maxNameLength' limit
- #1512: Number-parsing fix for 'UTF8DataInputJsonParser'
- #1548: 'StreamReadConstraints.maxDocumentLength' not checked
when creating parser with fixed buffer
- #1555: Enforce 'StreamReadConstraints.maxNumberLength' for
non-blocking (async) parser
- #1433: 'JsonParser#getNumberType()' throws
'JsonParseException' when the current token is non-numeric
instead of returning null
- #1446: Invalid package reference to "java.lang.foreign" from
'com.fasterxml.jackson.core:jackson-core' (from
'FastDoubleParser')
- #1391: Fix issue where the parser can read back old number
state when parsing later numbers
- #1397: Jackson changes additional values to infinite in case...