Jackson Release 2.22.1 date (fix CVE-2026-54515)

[AnhelinaM]

Hello!
Is there any current information about the planned release date for Jackson 2.22.1? We're monitoring the updates to fix CVE-2026-54515, but we'd like to confirm the approximate timeframe so we can adjust our plans accordingly. Thank you in advance for your response!

[pjfanning]

there are some comments on FasterXML/jackson-databind#6041 (comment)

[AnhelinaM]

thank you!

[pjfanning]

We should keep this open so that we can centralise all the question traffic.

There is a fix for CVE-2026-54515 / GHSA-5jmj-h7xm-6q6v in jackson 3.1.4 and 3.2.0 (already released)

[jankoh]

Coming from #6073: The main issue I filed the other report is that Spring boot uses both Jackson 2 and 3. We bumped jackson 3 to 3.1.4 last week, so that one is fine; but we had to bump jackson 2, too. The Issue was marked to be fixed in 2.21.5, which is unavailable, so I had to bump to 2.22.0, but CVE-2026-54515 now is marked to be in 2.22.0, too.

Best, Jan

[AnhelinaM]

CVE will be fixed in 2.22.1 (and 2.21.5), most likely they will be released soon (see FasterXML/jackson-databind#6041 (comment))

[psupriya1991]

Cannot move to Jackson3 at this point and vulnerability fix is not available for CVE-2026-54515. Commenting here so as to get the update on release of 2.21.5 or 2.22.1.

[JoshDM]

+1 for hearing about an official release date update.

[JooHyukKim]

See FasterXML/jackson-databind#6041 (comment)

[cowtowncoder]

Jackson 2.21.5 release starting now.

EDIT: and now completed.

[psupriya1991]

Thanks a lot for the update! Waiting for it to be available on maven now. :)

[ThomasKasene]

Well done :) Also, I hate to be that guy, but can we expect a 2.22.1 release as well?

[AnhelinaM]

thank you!
https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.21.5/

[cowtowncoder]

@ThomasKasene they all take 2 hours but today's your lucky day, 2.22.1 is next; starting now. 3.1.5 probably on friday; possibly 2.18.9 or 3.2.1 as well.