Jackson Release 2.13.5

Jump to bottom

Tatu Saloranta edited this page Nov 1, 2022 · 7 revisions

Possible patch version of 2.13, not yet released.

Following fixes would be included in this patch release.

Changes, core

Databind

#3590: Add check in primitive value deserializers to avoid deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS [CVE-2022-42003]

Changes, other

Jackson-jr

#98: module-info.java of jr-stree refers to module com.fasterxml.jackson.jr.ob.api, which is not defined