The aws-sdk ships with a vulnerable version of jackson-core

Open Beginner friendly

#7,379 opened on Sep 16, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 72/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Active
Tech stack: aws, java
Domain: backend, security

Research direction

Start by reproducing the vulnerability scan against AWS Java SDK version 2.42.5 and trace the software.amazon.awssdk:third-party-jackson-core dependency. Update the dependency to jackson-core 2.22.2 or newer, then rerun the scan and confirm that CVE-2026-68498 is no longer reported.

Written by the indexing model from the issue text.

Description

bug needs-triage

Describe the bug

Our vulnerability scan is reporting CVE-2026-68498, affecting software.amazon.awssdk : third-party-jackson-core
The CVE is fixed in recent versions of jackson-core (2.22.2).

Regression Issue

Select this option if this issue appears to be a regression.

Expected Behavior

No vulnerabilities reported

Current Behavior

The vulnerability scan reports CVE-2026-68498 with a base score of 8.7.

Reproduction Steps

Run a vulnerability scan

Possible Solution

Update jackson-core to 2.22.2 or newer.

Additional Information/Context

No response

AWS Java SDK version used

2.42.5

JDK version used

openjdk 21.0.12 2026-07-21

Operating System and version

Ubuntu Linux 22.04

Dominant language: Java
Stars: 2.6k
Forks: 1k
Avg merge: 2d 17h
Merged PRs (30d): 39

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Document Hot Rod migration version compatibility for Data Grid 8.6 Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

infinispan/infinispan#18150 · Opened Sep 21, 2026
[BUG] Route53Resolver: CreateResolverEndpoint requires IpAddressRequests, but the AWS member is IpAddresses, so no SDK client can call it Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

floci-io/floci#4108 · Opened Sep 21, 2026
[BUG] RestGetModelHandlerIT.testGetModel_whenModelIDIsInValid_thenFail depends on test order and fails when run alone Open

untriaged

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

opensearch-project/k-NN#3597 · Opened Sep 21, 2026
Concurrent builder skips 'verify' phase when running 'mvn install' Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

apache/maven#13230 · 1 comment · Opened Sep 21, 2026
ComponentGeNRTL leaves lnGamma stale after computing gamma Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

equinor/neqsim#3899 · 1 comment · Opened Sep 21, 2026

More Java issues