Track: jackson-databind CVE-2026-54515 — awaiting released fix (2.21.5)

[WolfTasks]

What

Backend Trivy MEDIUM finding CVE-2026-54515 — jackson-databind: ignored properties can be unexpectedly modified.

• Package: com.fasterxml.jackson.core:jackson-databind
• Installed: 2.21.4 (transitive; managed by Spring Boot 3.5.16 BOM → jackson-bom)
• Code-scanning alert: docs: fix GitHub repo slug taskowolf/TaskWolf → WolfTasks/TaskWolf #95

Why it's not fixed yet

Every fix version the advisory names is currently uninstallable, so there is no valid bump today:

Advisory fix	Status
2.21.5	not released (latest 2.21.x in Maven Central is 2.21.4)
2.22.1	not released (latest is 2.22.0, itself still vulnerable)
2.18.9	older line — a downgrade from 2.21
3.1.4	jackson 3.x major — incompatible with Spring Boot 3.5's jackson 2.x

Not urgent

CI's blocking Trivy gate is HIGH,CRITICAL only; this MEDIUM is visible-but-non-blocking by design. It does not fail the build.

Resolution path

Let the Spring Boot BOM carry the fix once jackson-databind 2.21.5 ships — Dependabot's backend-deps group will pull it via a Spring Boot patch bump. No manual override needed (and none is currently possible).

When 2.21.5 is released, verify it's picked up:

• backend/gradle.lockfile shows jackson-databind:2.21.5 (or newer)
• Trivy alert docs: fix GitHub repo slug taskowolf/TaskWolf → WolfTasks/TaskWolf #95 auto-closes on the next main scan
• If Spring Boot hasn't bumped jackson by then, add extra["jackson-bom.version"] = "2.21.5" in backend/build.gradle.kts (mirroring the commons-lang3 override in fix(security): bump commons-lang3 3.17.0 -> 3.18.0 (CVE-2025-48924) #32) and regenerate the lockfile

Related

• PR fix(security): bump commons-lang3 3.17.0 -> 3.18.0 (CVE-2025-48924) #32 — fixed the sibling commons-lang3 CVE-2025-48924; documents this deferral inline in build.gradle.kts

[WolfTasks]

Code-scanning alert #95 for this CVE has been dismissed (won't fix) rather than left open, since GitHub code-scanning alerts have no comment feature without dismissing. The dismissal note links back to this issue.

Alert: https://github.com/WolfTasks/TaskWolf/security/code-scanning/95

This issue remains the live tracker. When jackson-databind 2.21.5 ships and Dependabot bumps Spring Boot, verify per the checklist above — the dismissed alert should transition to fixed (or can be reopened to confirm) once the dependency actually moves.

[WolfTasks]

Aufgelöst — jackson-databind 2.21.5 ist ausgeliefert.

Checkliste erfüllt:

• backend/gradle.lockfile zeigt com.fasterxml.jackson.core:jackson-databind:2.21.5 (via v1.0.15 / PR fix(deps): bump jackson-bom 2.21.4 → 2.21.5 (@JsonView bypass CVEs) #93, jackson-bom-Override auf 2.21.5).
• Code-scanning Alert docs: fix GitHub repo slug taskowolf/TaskWolf → WolfTasks/TaskWolf #95 hat jetzt fixed_at = 2026-07-23 — Trivy erkennt die bewegte Abhängigkeit.
• 0 offene Code-Scanning-Alerts insgesamt.

CVE-2026-54515 ist damit remediiert. Kein manueller Override mehr nötig — der Spring-Boot-BOM-Pfad hat wie geplant getragen.