diff --git a/.build/owasp/dependency-check-suppressions.xml b/.build/owasp/dependency-check-suppressions.xml
index a2c92ebde3..f938b05f28 100644
--- a/.build/owasp/dependency-check-suppressions.xml
+++ b/.build/owasp/dependency-check-suppressions.xml
@@ -32,12 +32,6 @@
         <cve>CVE-2025-25193</cve>
     </suppress>
 
-    <!-- https://issues.apache.org/jira/browse/CASSANDRA-17966 -->
-    <suppress>
-        <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
-        <cve>CVE-2023-35116</cve>
-    </suppress>
-
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-19142 -->
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-20412 -->
     <suppress>
diff --git a/.build/parent-maven-pom.xml b/.build/parent-maven-pom.xml
index bc0c2bd6aa..fde8fb44c5 100644
--- a/.build/parent-maven-pom.xml
+++ b/.build/parent-maven-pom.xml
@@ -428,28 +428,29 @@
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
         <artifactId>jackson-core</artifactId>
-        <version>2.15.3</version>
+        <version>2.19.2</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
         <artifactId>jackson-databind</artifactId>
-        <version>2.15.3</version>
+        <version>2.19.2</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
         <artifactId>jackson-annotations</artifactId>
-        <version>2.15.3</version>
+        <version>2.19.2</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.datatype</groupId>
         <artifactId>jackson-datatype-jsr310</artifactId>
-        <version>2.15.3</version>
+        <version>2.19.2</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.dataformat</groupId>
         <artifactId>jackson-dataformat-yaml</artifactId>
-        <version>2.15.3</version>
+        <version>2.19.2</version>
         <scope>test</scope>
+        <!-- 2.19.2 would bring in snakeyaml 2.4, but we depend on 2.1 in prod code -->
         <exclusions>
           <exclusion>
             <artifactId>snakeyaml</artifactId>
diff --git a/.snyk b/.snyk
index aae9ae4084..79150117f0 100644
--- a/.snyk
+++ b/.snyk
@@ -2,8 +2,6 @@
 # This file is autogenerated from .build/dependency-check-suppressions.xml
 version: v1.25.0
 ignore:
-  CVE-2023-35116:
-    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
   CVE-2023-44487:
     - reason: https://issues.apache.org/jira/browse/CASSANDRA-18943 -- ^pkg:maven/io\.netty/netty\-.*@.*$
   CVE-2023-6378:
diff --git a/CHANGES.txt b/CHANGES.txt
index d3ce50120c..b61cd947e0 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -299,6 +299,7 @@ Merged from 4.1:
  * Enforce CQL message size limit on multiframe messages (CASSANDRA-20052)
  * Fix race condition in DecayingEstimatedHistogramReservoir during rescale (CASSANDRA-19365)
 Merged from 4.0:
+ * Update Jackson to 2.19.2 (CASSANDRA-20848)
  * Update commons-lang3 to 3.18.0 (CASSANDRA-20849)
  * Add NativeTransportMaxConcurrentConnectionsPerIp to StorageProxyMBean (CASSANDRA-20642)
  * Make secondary index implementations notified about rows in fully expired SSTables in compaction (CASSANDRA-20829)