Bug#1142111: jackson-databind: writeValueAsString() now throws IOException

Juan Manuel Méndez Rey juan.mendezr at proton.me
Sat Oct 3 03:30:04 BST 2026


Hi,

Both come from jackson-databind, so I reassigned them.

CVE-2025-52999.patch
(https://security-tracker.debian.org/tracker/CVE-2025-52999) adds
"throws IOException" to
ObjectMapper.writeValueAsString() and ObjectWriter.writeValueAsString().
Code that only catches JsonProcessingException no longer compiles.
Upstream fixed the CVE without changing the signature:
https://github.com/FasterXML/jackson-databind/commit/71003893a583da54e9a2b0fe619da64449bca673

Fix doing the same: https://salsa.debian.org/java-team/jackson-databind/-/merge_requests/11
With it libwikidata-toolkit-java builds again. jackson-modules-java8 also
needs the jackson-core fix for #1135411.

trixie and bookworm have the same patch, so these stay open there.

Thanks,
Juan



More information about the pkg-java-maintainers mailing list