This maintenance release addresses security vulnerabilities in Log4j and Jackson dependencies.
Highlights
-
Improper Encoding or Escaping of Output Remediation (CVE-2026-49844): Apache Log4j has been upgraded from 2.25.4 to 2.25.5 to address CVE-2026-49844 (CWE-116, Improper Encoding or Escaping of Output; CVSS 5.9, Medium). Log4j API versions 2.13.1 through 2.25.4 improperly encode non-finite IEEE 754 floating-point values (NaN, Infinity, -Infinity) in MapMessage.asJson(), emitting bare tokens that are not valid JSON under RFC 8259. Any layout that relies on MapMessage.asJson(), including JsonTemplateLayout, could produce corrupted log records and disrupt downstream log ingestion. The earlier fix for CVE-2026-34481 did not cover all affected code paths. All Log4j artifacts shipped with Geode move to 2.25.5: log4j-api, log4j-core, log4j-jcl, log4j-jul, and log4j-slf4j-impl.
-
Jackson upgraded to 2.21.5 (CVE-2026-54513): Jackson has been upgraded from 2.21.2 to 2.21.5 to address CVE-2026-54513 (CWE-184; CVSS 8.1, High). In jackson-databind from 2.10.0 up to 2.21.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists an array type based only on clazz.isArray() without validating the array's component type against the configured allowlist. A validator configured with allowIfSubTypeIsArray() alongside an explicit concrete-type allowlist would therefore accept an array whose element type was never allowlisted, and when no per-element type IDs are present Jackson instantiates that component type directly with no further validation. The upstream fix landed in 2.21.4; Geode takes 2.21.5. The upgrade covers jackson-core, jackson-databind, jackson-datatype-joda, and jackson-datatype-jsr310. jackson-annotations remains at 2.21, which is the current release on its own versioning cadence.
sha256 for apache-geode-1.15.5.tgz is ffa5778e6a8d788c50c677efc0b42ecb1d96068033229d68c01794d0ccd2a956
See full release notes at https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-1.15.5