[HTHou]

Description

Upgrade Jetty from 12.0.36 to 12.0.41 and Jackson from 2.18.11 to 2.18.12. Update LICENSE-binary to match the 14 bundled artifacts affected by these version changes.

The REST module previously resolved jetty-http:12.0.36 and jackson-databind:2.18.11, which are in the affected ranges of the upstream advisories. It now resolves jetty-http:12.0.41 and jackson-databind:2.18.12.

Published CVEs fixed in bundled components

Maven artifact	Advisories	First fixed version on this release line
org.eclipse.jetty:jetty-http	CVE-2026-19203	12.0.38
org.eclipse.jetty:jetty-server	CVE-2026-18660, CVE-2026-76182	12.0.39
org.eclipse.jetty:jetty-security	CVE-2026-19864	12.0.39
org.eclipse.jetty.ee10:jetty-ee10-servlet	CVE-2026-18659, CVE-2026-18662	12.0.39
com.fasterxml.jackson.core:jackson-databind	CVE-2026-110879, CVE-2026-54516	2.18.12

Validation

• Built the distribution reactor from a clean worktree on JDK 17 with mvn clean package -pl distribution -am -DskipTests.
• Passed all 23 REST unit tests.
• Verified the distribution ZIP checksums and binary license files, including all 14 upgraded artifact versions in the REST JARs bundled in all-bin and edge-bin.
• Started a freshly extracted Edge package with REST enabled, received HTTP 200 from GET /ping, and stopped the instance.