Skip to content

fix(CVE-2023-35116,CVE-2025-52999): upgrade jackson to 2.16.2 (Related to #15025)#15288

Merged
KomachiSion merged 1 commit into
alibaba:v2.x-developfrom
zmz789:fix/cve-15025-upgrade-jackson
Jun 2, 2026
Merged

fix(CVE-2023-35116,CVE-2025-52999): upgrade jackson to 2.16.2 (Related to #15025)#15288
KomachiSion merged 1 commit into
alibaba:v2.x-developfrom
zmz789:fix/cve-15025-upgrade-jackson

Conversation

@zmz789

@zmz789 zmz789 commented Jun 2, 2026

Copy link
Copy Markdown

What is the purpose of the change

升级 nacos v2.x 中依赖的 Jackson 版本至 2.16.2,修复:

Brief changelog

  1. 新增 <jackson.version>2.16.2</jackson.version>
  2. 在 中显式 import jackson-bom

Verifying this change

BOM 覆盖范围验证:jackson-databind、jackson-core 已覆盖
升级后实际依赖版本,均为 2.16.2:
$ mvn dependency:tree -pl distribution -am -Dincludes='com.fasterxml.jackson*'
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.16.2:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.16.2:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.16.2:compile
[INFO] +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.16.2:compile
[INFO] +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.16.2:compile
[INFO] +- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.16.2:compile

@CLAassistant

CLAassistant commented Jun 2, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@github-actions

github-actions Bot commented Jun 2, 2026

Copy link
Copy Markdown

Thanks for your this PR. 🙏
Please check again for your PR changes whether contains any usage/api/configuration change such as Add new API , Add new configuration, Change default value of configuration.
If so, please add or update documents(markdown type) in docs/next/ for repository nacos-group/nacos-group.github.io


感谢您提交的PR。 🙏
请再次查看您的PR内容,确认是否包含任何使用方式/API/配置参数的变更,如:新增API新增配置参数修改默认配置等操作。
如果是,请确保在提交之前,在仓库nacos-group/nacos-group.github.io中的docs/next/目录下添加或更新文档(markdown格式)。

@KomachiSion
KomachiSion merged commit 79acb21 into alibaba:v2.x-develop Jun 2, 2026
3 checks passed
@KomachiSion KomachiSion added this to the 2.5.3 milestone Jun 2, 2026
@KomachiSion KomachiSion added the dependencies Pull requests that update a dependency file label Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Nacos Server2.5.2版本引入的组件hessian-3.3.6.jar扫描发现CVE-2024-46983漏洞

3 participants