Forum Discussion

vivekkrraiii's avatar
vivekkrraiii
New Member
1 day ago

Recommended remediation for jackson-coreutils CVEs while retaining Swagger 1.x support

Title: Recommended remediation for jackson-coreutils CVEs while retaining Swagger 1.x support

Hi maintainers,

We use Swagger Parser 2.1.23 on Java 8 and may need to retain Swagger 1.x compatibility. Its legacy compatibility dependency chain brings in jackson-coreutils 2.0, flagged for CVE-2026-86513, CVE-2026-86511, and CVE-2026-86321.

In isolated Java 8 parser tests, excluding jackson-coreutils caused Swagger 1.2 conversion to fail with:
NoClassDefFoundError: com/github/fge/jackson/jsonpointer/JsonPointer

Our representative Swagger 2 and OpenAPI 3 imports still passed. Removing the legacy compatibility stack instead caused Swagger 1.2 documents to be rejected.

Is there a supported release, replacement dependency, or recommended mitigation that addresses these findings while preserving Swagger 1.x support and Java 8 compatibility?

We have not confirmed exploitability of these CVEs through Swagger Parser. Any guidance on their applicability to its parsing/conversion paths would also be appreciated.

Related upstream reports:

Thank you.

Swagger Core

1 Reply

  • yousaf's avatar
    yousaf
    Icon for Staff rankStaff
    24 minutes ago

    Hiya, welcome to the community.

    I have also replied on reddit, but have copied my reply here as well.

    Swagger Parser 2.1.23 is a 2 year old release.

    https://github.com/swagger-api/swagger-parser/releases/tag/v2.1.23

    Going by the docs, Swagger Parser 2.1.0+ supports OpenAPI 3.1 with Swagger Parser 1.x line having support for Swagger 1.0 / OpenAPI 2.0.

    We are working on the Jackson 3 upgrade across the ecosystem, but most likely won't be back-porting to the 1.x swagger parser line. We have accepted PR's to this branch, so I would recommend testing out your solution in a fork, and proposing the changes back, however I would also raise the issue on the GitHub repository, as you may get community support from others.

    Can you confirm where in the documentation or code, it shows that there is Swagger Spec 1.x compat in Swagger Parser 2.x line?