...

cowtowncoder · cowtowncoder · commit b51103dd073b · 2022-10-27T11:25:23.000-07:00
diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
@@ -21,6 +21,7 @@ Project: jackson-dataformat-xml
 #550: Use of `ClassLoader`-taking `newFactory()` variant breaks applications
   using default JDK XML implementation
  (reported by David-F E)
+* Upgrade Woodstox to 6.4.0 for a fix to [CVE-2022-40152]
 
 2.13.5 (not yet released)
 
