Known CVEs in dependencies bundled in keycloak-config-cli.jar (spring-core, spring-boot, jackson, jackson 3, logback)

A container CVE scan of the current keycloak-config-cli release flags a number of known vulnerabilities in libraries bundled inside `keycloak-config-cli.jar` (`BOOT-INF/lib/`), including one critical and several high severity findings.

## Findings

| File in jar | Findings (severity) | First fixed version |
|---|---|---|
| `spring-core-6.2.11.jar` | CVE-2026-41838 … CVE-2026-41855 (incl. **critical [CVE-2026-41855](https://nvd.nist.gov/vuln/detail/CVE-2026-41855)**; high CVE-2026-41842, CVE-2026-41845, CVE-2026-41848, CVE-2026-41850, CVE-2026-41851), CVE-2026-22735, CVE-2026-22737, CVE-2026-22740, CVE-2026-22741 | Spring Framework 6.2.19 |
| `spring-boot-3.4.5.jar` | [CVE-2026-40973](https://nvd.nist.gov/vuln/detail/CVE-2026-40973) (high) | Spring Boot 3.5.14 |
| `jackson-core-2.21.1.jar`, `jackson-databind-2.21.1.jar` | [GHSA-r7wm-3cxj-wff9](https://github.com/advisories/GHSA-r7wm-3cxj-wff9) (high), CVE-2026-54512 … CVE-2026-54518, CVE-2026-59888, CVE-2026-59889, [GHSA-mhm7-754m-9p8w](https://github.com/advisories/GHSA-mhm7-754m-9p8w) | Jackson 2.21.5 |
| `jackson-core-3.0.1.jar`, `jackson-databind-3.0.1.jar` (Jackson 3, `tools.jackson.core`) | [CVE-2026-29062](https://nvd.nist.gov/vuln/detail/CVE-2026-29062) (high), [GHSA-2m67-wjpj-xhg9](https://github.com/advisories/GHSA-2m67-wjpj-xhg9) (high), [GHSA-r7wm-3cxj-wff9](https://github.com/advisories/GHSA-r7wm-3cxj-wff9) (high), CVE-2026-54512 … CVE-2026-54518, CVE-2026-59888, CVE-2026-59889, [GHSA-72hv-8253-57qq](https://github.com/advisories/GHSA-72hv-8253-57qq) | tools.jackson 3.1.5 |
| `logback-core-1.5.25.jar` | [CVE-2026-9828](https://nvd.nist.gov/vuln/detail/CVE-2026-9828), [CVE-2026-10532](https://nvd.nist.gov/vuln/detail/CVE-2026-10532) (low) | Logback 1.5.33 / 1.5.34 |

Fixed versions were cross-checked against the GitHub Advisory Database and spring.io security advisories.

## Notes

- The Spring Framework and Spring Boot fixes are only available in the Spring Boot 3.5.x line (the 3.4.x line is EOL and did not receive them), so resolving these requires upgrading the Spring Boot parent from 3.4.5.
- The Jackson 3 (`tools.jackson.core`) artifacts are pulled in transitively by `net.logstash.logback:logstash-logback-encoder:9.0` (runtime scope). There is no newer release of the encoder, and Jackson 3 is not managed by the Spring Boot BOM, so an explicit `dependencyManagement` pin is needed.

I have a prepared fix (Spring Boot 3.5.16 + dependency pins) and will open a PR referencing this issue.