Jackson Release 2.13.3

Patch version of 2.13, released on May 14, 2022.

Following fixes are included in this patch release.

Changes, core

Streaming

• #744: Limit size of exception message in BigDecimalParser

None yet

Databind

• #2816: Optimize UntypedObjectDeserializer wrt recursion [CVE-2020-36518]
• #3412: Version 2.13.2 uses Method.getParameterCount() which is not supported on Android before API 26
• #3419: Improve performance of UnresolvedForwardReference for forward reference resolution
• #3446: java.lang.StringBuffer cannot be deserialized
• #3450: DeserializationProblemHandler is not working with wrapper type when returning null

Changes, data formats

Ion

• #317: IonValueDeserializer does not handle getNullValue correctly for a missing property

Changes, Other modules

Blackbird

• #169: Blackbird fails with LinkageError when the same class is used across two separate classloaders