Last Updated: 2026-10-11
Current status of open branches, with new releases, can be found from Jackson Releases wiki page
The main jackson/Security and quality page explains full Jackson Security Policy: usually you should just click "Report a vulnerability" you can see on the upper right corner of this page to report the vulnerability if it is related to code in this repository.
(for more in-depth explanation, see Apache Release Signing document)
To verify that any given Jackson artifact has been signed with a valid key, have a look at KEYS file of the main Jackson repo:
https://github.com/FasterXML/jackson/blob/master/KEYS
which lists all known valid keys in use.