Jackson Release 2.21.5

Patch version of 2.21, released on July 6, 2026.

Following fixes are included in this patch release.

Changes, core

Streaming

None

Databind

• #5962: Case-insensitive deserialization may use wrong @JsonIgnoreProperties [CVE-2026-54515]
• #6054: Honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties [GHSA-mhm7-754m-9p8w]
• #6058: Do not allow DNS resolution when deserializing InetAddress [CVE-2026-77310]
• #6060: @JsonView by-passed for @JsonUnwrapped Field/Setter properties [CVE-2026-59889]

Changes, dataformats

Protobuf

• #73: Cannot resolve inner types in protoc definitions
• #134 : oneof fields and some repeated fields incorrectly decoded for proto3 schemas
• #598: Protobuf parser state handling wrong for implicit close (END_OBJECT)