mongo-kafka-connect-3.0.0-confluent.jar bundles vulnerable jackson-databind (CVE-2026-54512 through CVE-2026-54518)

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Unknown
    • 3.0.1
    • Affects Version/s: 3.0.0
    • Component/s: None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Hi,

      The `mongo-kafka-connect-3.0.0-confluent.jar` uber JAR (distributed via Confluent Hub as `mongodb/kafka-connect-mongodb:3.0.0`) shades `com.fasterxml.jackson.core:jackson-databind` class files directly into the fat JAR. The bundled version is below 2.21.4 and carries the following CVEs:

      CVE-2026-54512 high

      CVE-2026-54513 high

      CVE-2026-54514 medium

      CVE-2026-54516 medium 

      CVE-2026-54517 medium 

      CVE-2026-54518 medium

      All are fixed in `jackson-databind` >= 2.21.4.

      Would it be possible to address this in a 3.0.1 patch release?

            Assignee:
            Calvin Nix
            Reporter:
            Goncalo Pinho (EXT)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: