Lower version of Jackson has CVE-2017-17485 deserialization flaw that is found by one of our customers during security scanning.