This issue is the same as https://issues.apache.org/jira/browse/HELIX-747 (it's a bit confusing which issue list should be used for this project as the documentation on https://cwiki.apache.org/confluence/display/HELIX/Contributor+Workflow doesn't seem to be up to date):
The current json lib Helix uses is out of date. We should consider replacing it with a well-maintained lib.
FasterXML/jackson is compatible with the current lib we used. So it could be a good candidate.
The old version of Jackson that Helix currently uses contains multiple CVEs:
CVE-2017-17485, CVE-2017-7525, CVE-2017-15095