These 3 issues basically.

https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

As Jackson is used in Spring, you can assume most banks, big corporations, etc. use it. So, update your dependencies and it's fine.

Gson is kind of to be avoided for the simple reason that it seems to be no longer maintained by Google. I've used it in the past and its fine but wouldn't pick it for something new because of this.

If you are using Kotlin, kotlinx serialization is worth a look. I've been using that recently. One of the nice things is that it relies on compiler plugins and code generation rather than a lot of reflective magic at runtime. From a security and performance point of view, that's a good thing.

kotlinx.serialization has a learning curve, but it is quite flexible and very fast. I've only used it on the JVM but obviously its cross-platform nature is a big plus as well.

It could use some simplified syntax (similar to how Kotson improved on Gson), perhaps a JPath parser. But for something that just went 1.0 very recently, it is terrific.

We are using kotlinx serialization in a multiplatform project where we use the same model classes in a cross platform API client and our Spring server. Tested this on Javascript and JVM so far and will likely add IOS there soonish.