[CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix

[igraecao]

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

core

Describe the bug

Keycloak ships jackson-databind 2.21.2 (via Quarkus BOM 3.33.2.1). Two Medium-severity CVEs affect this version:

CVE-2026-59888 (CVSS 6.5): Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy. Fixed in jackson-databind 2.21.4.

CVE-2026-59889 (CVSS 6.5): UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property without a prop.visibleInView() guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written under a less-privileged active view. Fixed in jackson-databind 2.21.5.

The Quarkus BOM will not include jackson-databind >= 2.21.4 until Quarkus 3.36.1 (currently KC uses 3.33.2.1). An independent jackson-bom override resolves both CVEs without requiring a full Quarkus uplift.

Expected behavior

Keycloak should ship jackson-databind >= 2.21.5 to address both CVEs.

Proposed fix

Add a jackson-bom import in pom.xml <dependencyManagement> section before the quarkus-bom import (Maven first-wins for BOM-managed versions):

<dependency>
    <groupId>com.fasterxml.jackson</groupId>
    <artifactId>jackson-bom</artifactId>
    <version>2.21.5</version>
    <type>pom</type>
    <scope>import</scope>
</dependency>

This is a patch-level bump (2.21.2 → 2.21.5) within the same minor version. The jackson-databind 2.21.x changelog (2.21.3, 2.21.4, 2.21.5) contains only bug fixes and security fixes with no API-breaking changes.

Version

All versions shipping jackson-databind >= 2.15.0 and < 2.21.4 (CVE-2026-59888) or < 2.21.5 (CVE-2026-59889).

[shawkins]

Thanks for the issue and pr, just wanted to add more context:

Java Records using a PropertyNamingStrategy

These are not used directly in Keycloak.

allowing a property annotated with both @JSONVIEW and @JsonUnwrapped

Json views are not used directly in Keycloak either.

So the only potential exposures in Keycloak would be if Quarkus has built in exploit paths or if a custom provider jar introduces something exploitable.

cc @vmuzikar @abstractj

[michalvavrik]

I mentioned it here #50956 (review), so sorry for repeating myself. I can see in 2.21.4 in branch 33.3 so in Quarkus 3.33.3 coming soon. I think getting bump to the Quarkus would be a better strategy. Let me try for 2.21.5, not sure if it is feasible.

[michalvavrik]

quarkusio/quarkus#55516 was merged, therefore I'd expect 3.33.3 to be based on 2.21.5 and we can bump Quarkus version in Keycloak.

[vmuzikar]

Marking as blocked externally, we should stick to the version Quarkus uses.

[thclaes]

Hi @vmuzikar,
As Quarkus 3.33.3 is released, I think the external block can be removed from this ticket: https://github.com/quarkusio/quarkus/releases/tag/3.33.3

Apologies if I'm missing a different ticket referencing the same upgrade.

[ahus1]

The Quarkus upgrade is tracked in #51344