Jackson Release 2.18.9

Patch version of 2.18, released on July 7, 2026.

Following fixes are included in this patch release.

Changes, core

Streaming

None

Databind

• #5962: Case-insensitive deserialization may use wrong @JsonIgnoreProperties [CVE-2026-54515]
• #6054: Honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties [GHSA-mhm7-754m-9p8w]
• #6058: Do not allow DNS resolution when deserializing InetAddress [CVE-2026-77310]
• #6060: @JsonView by-passed for @JsonUnwrapped Field/Setter properties [CVE-2026-59889]