jackson-databind vulnerabilities (AlmaLinux)

18 vulnerabilities.

• jackson-databind AlmaLinux jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service CVE-2026-68498 Fix available 7.5 HighSeptember 24, 2026
• jackson-databind AlmaLinux jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVE-2026-91777 Fix available 7.5 HighSeptember 23, 2026
• jackson-databind AlmaLinux jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth CVE-2026-89425 Fix available 7.5 HighSeptember 23, 2026
• jackson-databind AlmaLinux jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) CVE-2026-54513 Fix available 8.1 HighJune 23, 2026
• jackson-databind AlmaLinux jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data CVE-2025-52999 Public exploitFix available 8.7 HighJune 25, 2025
• jackson-databind AlmaLinux Deeply nested json in jackson-databind CVE-2020-36518 Public exploitFix available 7.5 HighMarch 11, 2022
• jackson-databind AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-10672 Fix available 8.8 HighMarch 18, 2020
• jackson-databind AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-10673 Public exploitFix available 8.8 HighMarch 18, 2020
• jackson-databind AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-9546 Fix available 9.8 CriticalMarch 2, 2020
• jackson-databind AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-9547 Public exploitFix available EPSS 18.4% 9.8 CriticalMarch 2, 2020
• jackson-databind AlmaLinux jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-9548 Public exploitFix available EPSS 18.9% 9.8 CriticalMarch 2, 2020
• jackson-databind AlmaLinux Deserialization of Untrusted Data in jackson-databind CVE-2020-8840 Public exploitFix available EPSS 26.6% 9.8 CriticalFebruary 10, 2020
• jackson-databind AlmaLinux Deserialization of Untrusted Data in jackson-databind CVE-2019-20330 Fix available 9.8 CriticalJanuary 3, 2020
• jackson-databind AlmaLinux jackson-databind polymorphic typing issue CVE-2019-17531 Fix available 9.8 CriticalOctober 12, 2019
• jackson-databind AlmaLinux jackson-databind polymorphic typing issue CVE-2019-16943 Fix available 9.8 CriticalOctober 1, 2019
• jackson-databind AlmaLinux Polymorphic Typing in FasterXML jackson-databind CVE-2019-16942 Fix available 9.8 CriticalOctober 1, 2019
• jackson-databind AlmaLinux Polymorphic Typing issue in FasterXML jackson-databind CVE-2019-16335 Fix available 9.8 CriticalSeptember 15, 2019
• jackson-databind AlmaLinux Polymorphic Typing issue in FasterXML jackson-databind CVE-2019-14540 Public exploitFix available EPSS 10.8% 9.8 CriticalSeptember 15, 2019