Package
druid
Component
jackson-databind
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The Druid Delta Lake extension includes the Apache Parquet parquet-jackson 1.12.3 jar, pulled in by Delta Kernel 3.2.1, which bundles its own shaded copy of Jackson 2.13.2. That shaded copy cannot be upgraded separately from the jar, and moving to the latest Parquet release (1.18.1) would not help because it bundles Jackson 2.22.2, which is also affected. This will be remediated when Parquet publishes a release that bundles a patched Jackson version.
Status