Error Code Crawler Maven Plugin 2.1.1, released 2026-07-27

Code name: Fixed vulnerabilities CVE-2026-54515, CVE-2026-59889, CVE-2026-9563

Summary

This release fixes the following 3 vulnerabilities:

CVE-2026-54515 (CWE-915) in dependency com.fasterxml.jackson.core:jackson-databind:jar:2.22.0:compile

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

References

• https://guide.sonatype.com/vulnerability/CVE-2026-54515?component-type=maven&component-name=com.fasterxml.jackson.core%2Fjackson-databind&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-54515
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v

CVE-2026-59889 (CWE-863) in dependency com.fasterxml.jackson.core:jackson-databind:jar:2.22.0:compile

Jackson Databind - Authorization bypass on JsonView Setter/Field

References

• https://guide.sonatype.com/vulnerability/CVE-2026-59889?component-type=maven&component-name=com.fasterxml.jackson.core%2Fjackson-databind&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-59889
• https://github.com/FasterXML/jackson-databind/issues/6060
• https://github.com/FasterXML/jackson-databind/pull/6056

CVE-2026-9563 (CWE-400) in dependency org.eclipse.parsson:parsson:jar:1.1.7:runtime

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.

References

• https://guide.sonatype.com/vulnerability/CVE-2026-9563?component-type=maven&component-name=org.eclipse.parsson%2Fparsson&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-9563
• https://github.com/eclipse-ee4j/parsson/pull/169
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/444

Security

• #124: Fixed vulnerability CVE-2026-54515 in dependency com.fasterxml.jackson.core:jackson-databind:jar:2.22.0:compile
• #125: Fixed vulnerability CVE-2026-59889 in dependency com.fasterxml.jackson.core:jackson-databind:jar:2.22.0:compile
• #126: Fixed vulnerability CVE-2026-9563 in dependency org.eclipse.parsson:parsson:jar:1.1.7:runtime

Dependency Updates

Compile Dependency Updates

• Updated com.exasol:error-code-model-java:2.1.4 to 2.1.5
• Updated com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.22.0 to 2.22.1
• Updated com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.0 to 2.22.1

Runtime Dependency Updates

• Removed org.slf4j:slf4j-jdk14:1.7.36

Test Dependency Updates

• Updated org.jacoco:org.jacoco.agent:0.8.14 to 0.8.15
• Updated org.junit.jupiter:junit-jupiter:6.1.0 to 6.1.2

Plugin Dependency Updates

• Updated com.exasol:error-code-crawler-maven-plugin:2.1.0 to 2.1.1
• Updated com.exasol:project-keeper-maven-plugin:5.6.2 to 5.7.4
• Removed com.exasol:quality-summarizer-maven-plugin:0.2.1
• Updated org.apache.maven.plugins:maven-dependency-plugin:3.10.0 to 3.11.0
• Updated org.apache.maven.plugins:maven-enforcer-plugin:3.6.2 to 3.6.3
• Updated org.apache.maven.plugins:maven-failsafe-plugin:3.5.5 to 3.5.6
• Updated org.apache.maven.plugins:maven-site-plugin:3.21.0 to 3.22.0
• Updated org.apache.maven.plugins:maven-surefire-plugin:3.5.5 to 3.5.6
• Added org.codehaus.mojo:build-helper-maven-plugin:3.6.1
• Updated org.jacoco:jacoco-maven-plugin:0.8.14 to 0.8.15
• Updated org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356 to 5.7.0.6970
• Updated org.sonatype.central:central-publishing-maven-plugin:0.10.0 to 0.11.0
• Added org.spdx:spdx-maven-plugin:1.0.4