The aws-sdk ships with a vulnerable version of jackson-core

[juan-comesana-curity]

Describe the bug

Our vulnerability scan is reporting CVE-2026-68498, affecting software.amazon.awssdk : third-party-jackson-core
The CVE is fixed in recent versions of jackson-core (2.22.2).

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

No vulnerabilities reported

Current Behavior

The vulnerability scan reports CVE-2026-68498 with a base score of 8.7.

Reproduction Steps

Run a vulnerability scan

Possible Solution

Update jackson-core to 2.22.2 or newer.

Additional Information/Context

No response

AWS Java SDK version used

2.42.5

JDK version used

openjdk 21.0.12 2026-07-21

Operating System and version

Ubuntu Linux 22.04

[debora-ito]

Looking at the corresponding Github Security Advisory, this was patched in jackson-core 2.21.6. The SDK bumped the jackson-core version last week via #7376 so please update the Java SDK to v2.54.20.

Let us know if this helps.