Jackson Release 2.21.2

Patch version of 2.21, released on February 20, 2026.

Following fixes are included in this patch release.

Changes, core

Streaming

• #1541: Unexpected Illegal surrogate character when parsing field names
• #1570: Fail parsing from DataInput if StreamReadConstraints.getMaxDocumentLength() set [GHSA-2m67-wjpj-xhg9]

Databind

• #5729: ISO-8601 change prevents parsing negative timestamps (dates before 1970)
• #5814: Enum deserialization does not respect JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_VALUES override

Changes, data formats

CSV

• #615: Feature CsvReadFeature.EMPTY_UNQUOTED_STRING_AS_NULL ignored

Changes, JVM Languages

Kotlin

• #1135: Compatibility with Kotlin 1.9 is provided (see kotlin#1129)