Vulnerability in docusign-esign-java

Question

The Docusign-esign-java libary released a new version (6.7.0) last on 7/1/2026; however, it still uses a version of com.fasterxml.jackson.core (2.17.1) that has a vulnerability (CVE GHSA-72hv-8253-57qq). This vulnerability was fixed in version 2.18.6 and 2.21.1. When can we expect docusign-esign-java to be updated to use a jackson.core version with the fix?

This is the entry in my pom.xml
       <dependency>
           <groupId>com.docusign</groupId>
           <artifactId>docusign-esign-java</artifactId>
           <version>6.7.0</version>
           <classifier>shaded</classifier>
       </dependency>
If I remove the shaded classifier then the application throws an error (java.lang.NoClassDefFoundError: com/fasterxml/jackson/databind/util/ISO8601DateFormat) when it tries to create a com.docusign.esign.client.ApiClient

Bruce C · Answer

The com.fasterxml.jackson.core (2.17.1) artifact used bydocusign-esign-java now has multiple vulnerabilities. One considered High risk (GHSA-r7wm-3cxj-wff9 7/21/2026) and two considered Medium risk (GHSA-72hv-8253-57qq 2/26/2026 andCVE-2026-59888 7//14/2026). When willdocusign-esign-java be updated to a current version of com.fasterxml.jackson? The use of this out of date library is impacting the security of every app that usesdocusign-esign-java.

Sign up

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.

Docusign Community

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.