Build: bump Jackson to fix CVE GHSA-r7wm-3cxj-wff9 by Guosmilesmile · Pull Request #17336 · apache/iceberg

Guosmilesmile · 2026-07-22T14:31:53Z

This PR updates the Spark 3.5 runtime Jackson dependency alignment to address GHSA-r7wm-3cxj-wff9.

Bumps Spark 3.5 forced Jackson dependencies from the jackson215 version set to jackson218.
Updates the Spark 3.5 runtime dependency baseline for jackson-core and jackson-databind.
Documents the remaining Kafka Connect runtime vulnerability finding as coming from the shaded Jackson copy embedded in parquet-jackson, which cannot be upgraded independently of Apache Parquet.

nssalian · 2026-07-22T23:35:26Z

@Guosmilesmile thanks for putting this fix. Seeing CI failures in other PRs. Would be great to get this in. Do you mind adding the description to the PR so the change rationale is clear?

Guosmilesmile · 2026-07-23T01:52:57Z

@Guosmilesmile thanks for putting this fix. Seeing CI failures in other PRs. Would be great to get this in. Do you mind adding the description to the PR so the change rationale is clear?

OK

pvary · 2026-07-23T11:07:11Z

Thanks @Guosmilesmile!
I haven't found this, and merged #17344 as a quick fix.

Please rebase above the current as I like your better.

Maybe we can even try to upgrade Spark 3.5 to the new version too. If that works that would be even better.

Guosmilesmile · 2026-07-23T12:09:23Z

Thanks @Guosmilesmile! I haven't found this, and merged #17344 as a quick fix.

Please rebase above the current as I like your better.

Maybe we can even try to upgrade Spark 3.5 to the new version too. If that works that would be even better.

@pvary Thank you very much for the reminder. I removed the "ignore" section for Spark, and aligned the 3.5 version with the 4.1 version by upgrading it.

pvary · 2026-07-23T15:26:32Z

GHSA-r7wm-3cxj-wff9

+        force "com.fasterxml.jackson.module:jackson-module-scala_${scalaVersion}:${libs.versions.jackson221.get()}"
+        force "com.fasterxml.jackson.core:jackson-databind:${libs.versions.jackson221.get()}"
+        force "com.fasterxml.jackson.core:jackson-core:${libs.versions.jackson221.get()}"


If we do this, do we need the GHSA-r7wm-3cxj-wff9 in spark-runtime-3.5.trivyignore?

Also, how sure are we that Spark works with a different fasterxml version?

If we do this, do we need the GHSA-r7wm-3cxj-wff9 in spark-runtime-3.5.trivyignore?

Yes, so I remove GHSA-r7wm-3cxj-wff9 in spark-runtime-3.5.trivyignore.

Also, how sure are we that Spark works with a different fasterxml version?

Good question. Since com.fasterxml is relocated to org.apache.iceberg.shaded.com.fasterxml(relocate 'com.fasterxml', 'org.apache.iceberg.shaded.com.fasterxml'), the Jackson copy included in the Iceberg runtime jar is isolated from Spark's own Jackson jars and should not override them.

I verified dependency resolution for Spark 3.5 and it now resolves jackson-core, jackson-databind, and jackson-module-scala_2.12 to 2.21.4.

However, that is not a full compatibility guarantee, so we should validate this with Spark 3.5 tests.

Good. Let's remove and see.

Also we might want to ask someone with more spark experience.
Maybe @szehon-ho or @huaxingao?

What do you think @szehon-ho or @huaxingao: If we change the relocated jackson version from 2.15.2 to 2.21.4, would that cause any issues for the users if the Spark test are green?

My previous submission has already removed the GHSA-r7wm-3cxj-wff9 in spark-runtime-3.5.trivyignore.

As for the rest, let's hear what others think.

each version of spark is using a different override right now

spark v3.5 is currently using jackson215

spark v4.0 is currently using jackson218

spark v4.1 is currently using jackson221

Looks like the CVE suggests 2.18.8 as the minimum version, GHSA-r7wm-3cxj-wff9

Should we use that instead of 2.21?

Do we actually need this bump? The CVE (GHSA-r7wm-3cxj-wff9) is a DoS in Jackson's async/non-blocking parser, which isn't used on Iceberg's parsing paths (we use the blocking parser), and the jar is shaded — so it's not a reachable issue for us, just a scanner finding we already suppress.

If we do want to fix it (e.g. to keep downstream scanners quiet), I'd lean toward 2.18.8: it's the minimal patched version that clears the finding (Spark 4.0 ships it and needs no ignore), and it's the smallest jump from 3.5's native 2.15.2.

Do we actually need this bump?

I agree. If we dont exercise this particular code path then lets not bump this and avoid potentially introducing new issues

This PR was originally meant to fix the CVEs for both Kafka and Spark together. The Kafka part has already been merged. As for the Spark part, I feel that if we can fix the vulnerability by bumping the jar version, that might be a cleaner approach than just suppressing it in spark-runtime-3.5.trivyignore.
That said, I'm happy to go with whatever the majority thinks is best here :)

Guosmilesmile · 2026-07-24T00:31:19Z

Change spark jackson 2.21 to 2.18 to keep the smallest jump

manuzhang · 2026-07-24T04:38:14Z

CVE-2026-54512

 # jackson-databind CVEs that are only fixed in jackson >= 2.18.8.
 CVE-2026-54512
 CVE-2026-54513
-GHSA-r7wm-3cxj-wff9


is this file still accurate after bumping jackson to 2.18.8?

Thanks for pointing it out. Also remove CVE-2026-54512 and CVE-2026-54513.

looks like this file is now empty, and we can either remove it completely or keep only a skeleton. but we should remove the lines about jackson

Make sense. Remove the lines about jackson now.

kevinjqliu

LGTM.

I see the tradeoff as:

Upgrade to 2.18.8: Small compatibility risk, mitigated by shading and the existing test coverage.
Stay on 2.15: Very low current exploitability, but continue shipping known-vulnerable code with future reachability and compliance risk.

I lean towards the upgrade. The current tests provide sufficient coverage to keep the compatibility risk low.

kevinjqliu · 2026-07-27T17:13:11Z

 # jackson-databind CVEs that are only fixed in jackson >= 2.18.8.
 CVE-2026-54512
 CVE-2026-54513
-GHSA-r7wm-3cxj-wff9


looks like this file is now empty, and we can either remove it completely or keep only a skeleton. but we should remove the lines about jackson

mbutrovich

I lean towards the upgrade. The current tests provide sufficient coverage to keep the compatibility risk low.

I agree with this assessment. I think the reasoning to do a minimal 2.18.8 bump, despite Iceberg not using the code path in question, is the right call. We're minimizing the risk of surprise changes by not jumping to a much newer version, and we have CI as a backstop for correctness.

kevinjqliu · 2026-07-28T20:02:42Z

 CVE-2026-54512
 CVE-2026-54513
+# jackson-core CVE shaded into parquet-jackson, only fixed in jackson
+# >= 2.18.8 / 2.21.4 / 2.22.1.
 GHSA-r7wm-3cxj-wff9


we should look into cleaning these up too

@Guosmilesmile do you mind following up with the items here?

I will raise a pr to fix it later

kevinjqliu · 2026-07-28T20:04:20Z

Im comfortable moving forward with this PR, thanks @Guosmilesmile for the fix and everyone for the review!

github-actions Bot added spark build KAFKACONNECT labels Jul 22, 2026

Guosmilesmile changed the title ~~Build: bump Jackson from 2.15 to 2.18 to fix CVE GHSA-r7wm-3cxj-wff9~~ Build: bump Jackson to fix CVE GHSA-r7wm-3cxj-wff9 Jul 22, 2026

Guosmilesmile mentioned this pull request Jul 22, 2026

Flink: BackPort Add plannedGroups counter metric and log for DataFileRewritePlanner to 2.0 and 1.20 #17335

Merged

github-actions Bot added INFRA and removed KAFKACONNECT labels Jul 22, 2026

nssalian mentioned this pull request Jul 22, 2026

Spark: Fix ColumnVectorWithFilter child vectors #16913

Open

nssalian requested review from kevinjqliu and nastra and removed request for kevinjqliu July 22, 2026 23:46

wombatu-kun approved these changes Jul 23, 2026

View reviewed changes

nssalian approved these changes Jul 23, 2026

View reviewed changes

Guosmilesmile added 2 commits July 23, 2026 19:50

Build: bump Jackson to fix CVE GHSA-r7wm-3cxj-wff9

664f03d

Build: bump Jackson to fix CVE GHSA-r7wm-3cxj-wff9

2e7b70c

Guosmilesmile force-pushed the fix_cve branch from 1a8118d to 2e7b70c Compare July 23, 2026 12:04

laskoviymishka approved these changes Jul 23, 2026

View reviewed changes

pvary reviewed Jul 23, 2026

View reviewed changes

change to 2.18

232ce82

manuzhang reviewed Jul 24, 2026

View reviewed changes

Comment thread spark/v3.5/build.gradle

Guosmilesmile added 2 commits July 24, 2026 12:55

remove CVE-2026-54512 and CVE-2026-54513

14d4dd1

remove jackson215

e9fd8fd

kevinjqliu approved these changes Jul 27, 2026

View reviewed changes

Remove line about jackson in spark ignore

1c6fafc

kevinjqliu requested a review from huaxingao July 28, 2026 15:05

mbutrovich approved these changes Jul 28, 2026

View reviewed changes

nssalian approved these changes Jul 28, 2026

View reviewed changes

huaxingao approved these changes Jul 28, 2026

View reviewed changes

kevinjqliu reviewed Jul 28, 2026

View reviewed changes

kevinjqliu merged commit 49b2556 into apache:main Jul 28, 2026
36 checks passed

Guosmilesmile deleted the fix_cve branch July 28, 2026 23:28

Uh oh!

Conversation

Guosmilesmile commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nssalian commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Guosmilesmile commented Jul 23, 2026

Uh oh!

pvary commented Jul 23, 2026

Uh oh!

Guosmilesmile commented Jul 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Guosmilesmile commented Jul 24, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kevinjqliu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mbutrovich left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kevinjqliu commented Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Guosmilesmile commented Jul 22, 2026 •

edited

Loading

nssalian commented Jul 22, 2026 •

edited

Loading