[lnearlol]

Description

Fixes CVE-2026-68495, CVE-2026-68496, CVE-2026-68497, CVE-2026-68498, CVE-2026-89407, CVE-2026-89425, CVE-2026-91777, CVE-2026-104016, CVE-2026-104895, CVE-2026-106554, CVE-2026-110747, CVE-2026-110879

Target

• I checked that the commit is targeting the correct branch (Camel 4 uses the main branch)

Tracking

• If this is a large change, bug fix, or code improvement, I checked there is a JIRA issue filed for the change (usually before you start working on it).

Apache Camel coding standards and style

• I checked that each commit in the pull request has a meaningful subject line and body.

• I have run mvn clean install -DskipTests locally from root folder and I have committed all auto-generated changes.

AI-assisted contributions

• If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., Co-authored-by trailers) and the PR description identifies the AI tool used.

[gnodet-bot]

This is a security-critical dependency upgrade — 12 CVEs are referenced in the description, and the upgrade is a backport to camel-4.22.x of what is already applied on main (which already carries 2.22.4 / 3.2.4). The bump itself is correct and the target branch is appropriate.

CVE description accuracy: Cross-referencing the 12 CVEs listed against the upstream Jackson release notes (jackson-databind, jackson-core):

• Confirmed in Jackson 2.22.1–2.22.4 or Jackson 3.2.2–3.2.4 release notes:

  • CVE-2026-68497 (jackson-databind 2.22.2: XMLGregorianCalendar number-len constraint)
  • CVE-2026-68498 (jackson-core 2.22.x / jackson-core 3.2.2: maxNameLength enforcement)
  • CVE-2026-89407 (jackson-core: looksLikeValidNumber fix)
  • CVE-2026-89425 (jackson-core: UTF8DataInputJsonParser token-length fix)
  • CVE-2026-91777 (jackson-databind 2.22.3: quadratic forward-reference resolution)
  • CVE-2026-110879 (jackson-databind 2.22.4: PolymorphicTypeValidator type-parameter bypass)

• Not found in the Jackson 2.22.x or 3.2.x release notes reviewed:

  • CVE-2026-68495, CVE-2026-68496, CVE-2026-104016, CVE-2026-104895, CVE-2026-106554, CVE-2026-110747

  These 6 CVEs may belong to other Jackson sub-projects (e.g. jackson-dataformat-*, jackson-modules-*) or were generated incorrectly. Please verify each one maps to an actual CVE and that it is patched by this exact version bump — if any are from components not managed by the jackson2-version or jackson3-version BOM properties, the description should clarify that or omit the unrelated IDs.

• Also fixed but not listed in the description:

  • CVE-2026-54515, CVE-2026-59889, CVE-2026-77310 (jackson-databind 2.22.1)
  • CVE-2026-19032, CVE-2026-83557 (jackson-databind 2.22.2)
  • CVE-2026-91776 (jackson-databind 2.22.3)

The description should be updated to list only confirmed CVEs (or at minimum document the source for each claimed fix).

---

All checklist items in the PR template are unchecked. For a security-patch backport, please confirm:

1. ✅ Branch target is camel-4.22.x (correct here — this is a backport, the note in the template refers to new feature PRs targeting main)
2. The build was run locally (mvn clean install -DskipTests) — standard requirement for Camel contributions

This review was generated by an AI agent, Hermès on behalf of @gnodet.

[davsclaus]

TL;DR: LGTM, a CVE-driven patch bump on the LTS branch, to the same versions main has used since late October.

The GitHub advisories (e.g. CVE-2026-91777 / GHSA-cxp5-3px4-pw24, high) affect jackson-databind 2.22.0-2.22.2 and 3.2.0-3.2.2, so this is a security fix as the LTS policy expects. Both changes are patch bumps within 2.22.x / 3.2.x, and main has had 2.22.4 / 3.2.4 since #28290 / #28292. Both BOMs keep jackson-annotations at 2.22, and the version properties are only used as ${...}, so nothing else needs to change. The stale camel-sbom.json is regenerated separately. Thanks!

Claude Code on behalf of davsclaus. This review was generated by an AI agent and may contain inaccuracies; please verify all suggestions before applying.

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[github-actions]

🧪 CI tested the following changed modules:

• parent

✅ POM dependency changes: targeted tests included

Changed properties: jackson2-version,jackson3-version

Modules affected by dependency changes (10)

• :camel-docling
• :camel-langchain4j-chat
• :camel-rest-openapi
• :camel-cxf-spring-rest
• :camel-pqc
• :camel-telemetry-dev
• :camel-jackson3-avro
• :camel-jackson3
• :camel-jackson3-protobuf
• :camel-jackson3xml

---

🔬 Scalpel shadow comparison — Scalpel: 40 tested, 29 compile-only — current: 0 all tested

Maveniverse Scalpel detected 69 affected modules (current approach: 0).

⚠️ Modules only in Scalpel (69)

• apache-camel
• camel-a2a
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-cxf-spring-rest
• camel-docling
• camel-endpointdsl
• camel-endpointdsl-support
• camel-groovy
• camel-iso8583
• camel-itest
• camel-jackson3
• camel-jackson3-avro
• camel-jackson3-protobuf
• camel-jackson3xml
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-mcp
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-test
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-jsonpath
• camel-kamelet
• camel-kamelet-main
• camel-knative-http
• camel-langchain4j-agent
• camel-langchain4j-chat
• camel-langchain4j-tools
• camel-launcher
• camel-launcher-container
• camel-mcp-server
• camel-micrometer-prometheus
• camel-oauth
• camel-observability-services
• camel-once
• camel-openai
• camel-openapi-validator
• camel-platform-http-main
• camel-platform-http-vertx
• camel-pqc
• camel-report-maven-plugin
• camel-rest-openapi
• camel-route-parser
• camel-telemetry-dev
• camel-test-infra-all
• camel-test-infra-openai-mock
• camel-test-main-junit5
• camel-test-main-junit6
• camel-xml-io-dsl
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin
• coverage
• docs
• dummy-component

Changed properties: jackson3-version, jackson2-version

Changed managed dependencies: com.fasterxml.jackson:jackson-bom, tools.jackson:jackson-bom

Skip-tests mode would test 40 modules (11 direct + 29 downstream), skip tests for 29 (generated code, meta-modules)

Modules Scalpel would test (40)

• camel-a2a
• camel-cxf-spring-rest
• camel-docling
• camel-groovy
• camel-iso8583
• camel-jackson3
• camel-jackson3-avro
• camel-jackson3-protobuf
• camel-jackson3xml
• camel-jbang-mcp
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-jsonpath
• camel-kamelet
• camel-knative-http
• camel-langchain4j-agent
• camel-langchain4j-chat
• camel-langchain4j-tools
• camel-launcher-container
• camel-mcp-server
• camel-micrometer-prometheus
• camel-oauth
• camel-observability-services
• camel-once
• camel-openai
• camel-openapi-validator
• camel-platform-http-main
• camel-platform-http-vertx
• camel-pqc
• camel-rest-openapi
• camel-telemetry-dev
• camel-test-infra-all
• camel-test-infra-openai-mock
• camel-test-main-junit5
• camel-test-main-junit6
• camel-xml-io-dsl
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin

Modules with tests skipped (29)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

All tested modules (70 modules)

• Camel :: AI :: A2A
• Camel :: AI :: Docling
• Camel :: AI :: LangChain4j :: Agent
• Camel :: AI :: LangChain4j :: Chat
• Camel :: AI :: LangChain4j :: Tools (deprecated)
• Camel :: AI :: MCP Server
• Camel :: AI :: OpenAI
• Camel :: All Components Sync point
• Camel :: Assembly
• Camel :: CXF :: REST :: Spring
• Camel :: Catalog :: CSimple Maven Plugin (deprecated)
• Camel :: Catalog :: Camel Catalog
• Camel :: Catalog :: Camel Report Maven Plugin
• Camel :: Catalog :: Camel Route Parser
• Camel :: Catalog :: Console
• Camel :: Catalog :: Dummy Component
• Camel :: Catalog :: Lucene (deprecated)
• Camel :: Catalog :: Maven
• Camel :: Catalog :: Suggest
• Camel :: Component DSL
• Camel :: Coverage
• Camel :: Docs
• Camel :: Endpoint DSL
• Camel :: Endpoint DSL :: Support
• Camel :: Groovy
• Camel :: ISO-8583
• Camel :: Integration Tests
• Camel :: JBang :: Core
• Camel :: JBang :: Integration tests
• Camel :: JBang :: MCP
• Camel :: JBang :: Main
• Camel :: JBang :: Plugin :: Edit
• Camel :: JBang :: Plugin :: Generate
• Camel :: JBang :: Plugin :: Kubernetes
• Camel :: JBang :: Plugin :: MCP
• Camel :: JBang :: Plugin :: Route Parser
• Camel :: JBang :: Plugin :: TUI
• Camel :: JBang :: Plugin :: Testing
• Camel :: JBang :: Plugin :: Validate
• Camel :: JSon Path
• Camel :: Jackson 3
• Camel :: Jackson 3 Avro
• Camel :: Jackson 3 Protobuf
• Camel :: Jackson 3 XML
• Camel :: Kamelet
• Camel :: Kamelet Main
• Camel :: Knative HTTP
• Camel :: Launcher
• Camel :: Launcher :: Container
• Camel :: Micrometer :: Prometheus
• Camel :: OAuth
• Camel :: Observability Services
• Camel :: Once
• Camel :: OpenAPI :: Validator
• Camel :: PQC
• Camel :: Parent
• Camel :: Platform HTTP :: Main
• Camel :: Platform HTTP :: Vert.x
• Camel :: REST OpenApi
• Camel :: Telemetry :: Dev
• Camel :: Test :: Main :: JUnit5
• Camel :: Test :: Main :: JUnit6
• Camel :: Test Infra :: All test services
• Camel :: Test Infra :: OpenAI Mock
• Camel :: XML DSL with camel-xml-io
• Camel :: YAML DSL
• Camel :: YAML DSL :: Deserializers
• Camel :: YAML DSL :: Maven Plugins
• Camel :: YAML DSL :: Validator
• Camel :: YAML DSL :: Validator Maven Plugin

---

⚙️ View full build and test results