From 71aa605e40e139347ff5ae355072d65994101e7d Mon Sep 17 00:00:00 2001
From: Katherine Chen <katherine.chen@thetradedesk.com>
Date: Mon, 27 Jul 2026 12:36:10 +1000
Subject: [PATCH] [Security] Upgrade jackson to 2.21.4 and Netty to
 4.1.136.Final

Resolves HIGH-severity vulnerabilities flagged by the Trivy scan:
- jackson-databind: CVE-2026-54512 (arbitrary code execution), CVE-2026-54513
  (security bypass). Fixed via jackson-bom 2.21.4 import in dependencyManagement.
- Netty: CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901.
  netty.version 4.1.135.Final -> 4.1.136.Final.

UID2-7569 UID2-7570 UID2-7571 UID2-7572 UID2-7573 UID2-7574

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 pom.xml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index bb15ad92f..0683965b5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,8 @@
         <maven.compiler.source>21</maven.compiler.source>
         <maven.compiler.target>21</maven.compiler.target>
         <java.version>21</java.version>
-        <netty.version>4.1.135.Final</netty.version>
+        <netty.version>4.1.136.Final</netty.version>
+        <jackson.version>2.21.4</jackson.version>
     </properties>
 
 
@@ -48,6 +49,14 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- Force jackson to a fixed version to resolve CVE-2026-54512, CVE-2026-54513 (UID2-7569, UID2-7570). -->
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-bom</artifactId>