It's not. Jackson has been aware of that for some time. Initially it was hoped a blacklist would be good enough, but it wasn't. In the latest 2.10 version, the

It's not. Jackson has been aware of that for some time. Initially it was hoped a blacklist would be good enough, but it wasn't. In the latest 2.10 version, the unsafe way is deprecated and an alternative. It must be noted that the vast majority of Jackson use cases is not affected, you need to enable an optional feature that has been known to be unsafe for years [1] [1] https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-...