-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 15 Oct 2026 09:28:11 +0200 Source: jackson-databind Architecture: source Version: 2.18.11-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Emmanuel Bourg <ebourg@apache.org> Closes: 1145887 1146640 1147507 Changes: jackson-databind (2.18.11-1) unstable; urgency=medium . * Team upload. * New upstream release - Fixes CVE-2026-54512, CVE-2026-54513, CVE-2026-54514 and CVE-2026-54515 (Closes: #1145887) - Fixes CVE-2026-83557: Comparable was missing from the unsafe base types of DefaultBaseTypeLimitingValidator (Closes: #1146640) - Fixes CVE-2026-68497: the XML datatype deserializers did not bound the length of stringified numbers (Closes: #1147507) - Updated the Maven rules - Removed the patches, no longer needed - Tightened the dependencies on jackson-core and jackson-annotations * Converted debian/watch to the version 5 format Checksums-Sha1: ba3831fa45c2dbf1ef1667d067ed5e1ab4603a50 2427 jackson-databind_2.18.11-1.dsc 4e114dbb08c9b92c162ced5a1d7a84d7633a7bd8 1170644 jackson-databind_2.18.11.orig.tar.xz f18d3c14478cad2d79000c1d9b4007e6c259a05d 7804 jackson-databind_2.18.11-1.debian.tar.xz dcb098e82e26b554b2e8ead1d8f1c76d573c3cc0 20099 jackson-databind_2.18.11-1_source.buildinfo Checksums-Sha256: 0b0c8dc995a1cf78b19a68650dab0f160608f3b420e7d8a9a9ce0a1c8724da23 2427 jackson-databind_2.18.11-1.dsc 7953119f3ebf50c226fdb8fbe88455b193584ceefb7cd9454ab1a6695d231628 1170644 jackson-databind_2.18.11.orig.tar.xz 19356d3a80146bc1b19aa6d5a5afa2e6dfb924891253cbf6de22715a54628648 7804 jackson-databind_2.18.11-1.debian.tar.xz c4fe24ba350344e2dbfefa6442cc4978884bce9f3f9564790a0e0ab972410eb4 20099 jackson-databind_2.18.11-1_source.buildinfo Files: d514eb00bf94bd721b73ce68c12a6c96 2427 java optional jackson-databind_2.18.11-1.dsc 057a642aa2a319add0ea4f864e08b321 1170644 java optional jackson-databind_2.18.11.orig.tar.xz 108ff1d3cc42a393aa75c88aee0e9f2c 7804 java optional jackson-databind_2.18.11-1.debian.tar.xz a73e70765d2dbae7d6e1023de3c20547 20099 java optional jackson-databind_2.18.11-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrQzG4SHGVib3VyZ0Bh cGFjaGUub3JnAAoJEPUTxBnkudCsDFIQAJTLxLe2bJjhQa0NS/Lj/8LOMzuGXD6x lPmxacmX3pjqevjiK/SWuE62Q7c0hZnGDNwl2don0V7rLcHmU3R/x5LHcpMC1i6e 6tlmdPuQMgRShionp71/r649DvaCrT9c2cixTEJnwgODsEjR9Qu0+bfEz0LMS0P/ BF9eZ3KathkaPARxWCbeNTBV+6eAd3jE+GjutaAOI5B14Ne03camT3gLADXtecjf 352CVv4lNCMBB1ehzdOq5l43qjYvIiBPf7JY262pBsY17tyuu9nFuPfswowXQNky 15t30OfGrHjsY99VWa3a0CNYNKck1ilKey7UMW/tNEGw7PuW1voshi3UeDC08gO8 Mcujiw56qGHxlhciGjXJ9e7GUOA3QnVrQgorpB1Co4CoBefhQsVOfMg1NLv5nrXS 78Edig/J6NHXi5Q+8xRnBL3eYVXaioIzO2VdadNKmDEAxU3ooBX52MRQ9k31WAhn CqtYc+TNeH5CPqWL40zaYIuSC02ni2DMmoeee8ewE5jEmyA0jrz14BBOJfP1gLnW 8fOln1h9D6IYUdDXCaOfglKAumlUP+QCcivgLogTtQx7kIooOdjmEFmf5vL0biJA ZQ8GeY5aIaQneP0d8JPZXkWOuvAxlSfHhK8bI7e+4ssuCLwqlKP4+k4WuOwi2eMj vL8c01hft3zz =Ir20 -----END PGP SIGNATURE-----
