Vulnerability in docusign-esign-java

Forum|Forum|1 month ago
July 8, 2026
6 replies
271 views

The Docusign-esign-java libary released a new version (6.7.0) last on 7/1/2026; however, it still uses a version of com.fasterxml.jackson.core (2.17.1) that has a vulnerability (CVE GHSA-72hv-8253-57qq). This vulnerability was fixed in version 2.18.6 and 2.21.1. When can we expect docusign-esign-java to be updated to use a jackson.core version with the fix?

This is the entry in my pom.xml
       <dependency>
           <groupId>com.docusign</groupId>
           <artifactId>docusign-esign-java</artifactId>
           <version>6.7.0</version>
           <classifier>shaded</classifier>
       </dependency>
If I remove the shaded classifier then the application throws an error (java.lang.NoClassDefFoundError: com/fasterxml/jackson/databind/util/ISO8601DateFormat) when it tries to create a com.docusign.esign.client.ApiClient

Java SDK

Bruce C

Author

New Voice

The com.fasterxml.jackson.core (2.17.1) artifact used by docusign-esign-java now has multiple vulnerabilities. One considered High risk (GHSA-r7wm-3cxj-wff9 7/21/2026) and two considered Medium risk (GHSA-72hv-8253-57qq 2/26/2026 and CVE-2026-59888 7//14/2026). When will docusign-esign-java be updated to a current version of com.fasterxml.jackson? The use of this out of date library is impacting the security of every app that uses docusign-esign-java.

emily.cook

Community Admin

Hi @Bruce C, welcome to the community and thank you for bringing this to our attention. I’m triaging to the right team and will get an update for you as soon as possible!

Emily @ Docusign

emily.cook

Community Admin

Sorry for the delay @Bruce C, our teams are investigating and I’ll provide a more detailed update for you as soon as I can

Emily @ Docusign

emily.cook

Community Admin

Thanks again for bringing this to our attention @Bruce C,

After an initial assessment, we confirmed that the Docusign eSignature Java SDK includes a version of jackson-core affected by GHSA-72hv-8253-57qq. However, the SDK doesn’t use the vulnerable non-blocking JSON parser APIs described in the disclosure. It uses a standard Jackson ObjectMapper with Jersey deserialization to process eSignature API responses instead.

Based on this assessment, Docusign customers can continue using the SDK. We haven’t identified an exploitable path through its normal API or OAuth response-processing flows.

If further investigation identifies an applicable issue, we’ll update accordingly!

Emily @ Docusign

Bruce C

Author

New Voice

Isn’t that like saying your car has some tnt in the trunk but it isn’t used so there is no need to remove it? :)

It doesn’t matter if your SDK doesn’t use the vulnerable parser, it is still included. Our corporate security scanners see it in image and flag it as a High security risk. If it ever becomes critical we will be blocked from migrating any code with your library into a production environment.

Inbar.Gazit

Docusign Employee

@Bruce C We understand your concern. While the library does not pose a security risk as used in this SDK, we are planning to release an updated version of the SDK with the revised dependency by August 19th

Sign up

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.

Docusign Community

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.