com.fasterxml.jackson.core:jackson-databind vulnerabilities (Root)

68 vulnerabilities.

• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVE-2026-91777 Fix available 7.5 HighSeptember 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVE-2026-91776 Fix available 7.5 HighSeptember 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service CVE-2026-68497 Fix available 7.5 HighSeptember 11, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types CVE-2026-83557 Fix available 5.6 MediumSeptember 1, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path CVE-2026-19032 Fix available 5.3 MediumSeptember 1, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) CVE-2026-77310 Fix available 5.3 MediumAugust 24, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization CVE-2026-59889 Fix available 6.5 MediumJuly 14, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy CVE-2026-59888 Fix available 6.5 MediumJuly 14, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind CVE-2026-54518 Fix available 6.5 MediumJune 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() CVE-2026-50193 Fix available 6.3 MediumJune 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation CVE-2026-54512 Public exploitFix available 8.1 HighJune 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) CVE-2026-54513 Fix available 8.1 HighJune 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) CVE-2026-54514 Fix available 5.3 MediumJune 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties CVE-2026-54515 Public exploitFix available 5.3 MediumJune 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields CVE-2026-54516 Fix available 5.3 MediumJune 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind: @JsonView bypass for setterless creator properties CVE-2026-54517 Fix available 5.3 MediumJune 23, 2026
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode CVE-2021-46877 Fix available 7.5 HighMarch 18, 2023
• com.fasterxml.jackson.core:jackson-databind Root Uncontrolled Resource Consumption in FasterXML jackson-databind CVE-2022-42004 Fix available 7.5 HighOctober 2, 2022
• com.fasterxml.jackson.core:jackson-databind Root Uncontrolled Resource Consumption in Jackson-databind CVE-2022-42003 Fix available 7.5 HighOctober 2, 2022
• com.fasterxml.jackson.core:jackson-databind Root Deeply nested json in jackson-databind CVE-2020-36518 Public exploitFix available 7.5 HighMarch 11, 2022
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind vulnerable to unsafe deserialization CVE-2020-10650 Fix available 8.1 HighApril 7, 2021
• com.fasterxml.jackson.core:jackson-databind Root Deserialization of untrusted data in jackson-databind CVE-2021-20190 Fix available 8.1 HighJanuary 19, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36179 Public exploitFix available EPSS 17.1% 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36180 Public exploitFix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36182 Fix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36183 Fix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36184 Public exploitFix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36185 Fix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36186 Fix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36187 Fix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36188 Public exploitFix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36189 Fix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-36181 Fix available 8.1 HighJanuary 6, 2021
• com.fasterxml.jackson.core:jackson-databind Root Serialization gadget exploit in jackson-databind CVE-2020-35728 Public exploitFix available EPSS 12.5% 8.1 HighDecember 27, 2020
• com.fasterxml.jackson.core:jackson-databind Root Serialization gadgets exploit in jackson-databind CVE-2020-35490 Fix available 8.1 HighDecember 17, 2020
• com.fasterxml.jackson.core:jackson-databind Root Serialization gadgets exploit in jackson-databind CVE-2020-35491 Fix available 8.1 HighDecember 17, 2020
• com.fasterxml.jackson.core:jackson-databind Root XML External Entity (XXE) Injection in Jackson Databind CVE-2020-25649 Fix available EPSS 17.7% 7.5 HighOctober 14, 2020
• com.fasterxml.jackson.core:jackson-databind Root Unsafe Deserialization in jackson-databind CVE-2020-24750 Public exploitFix available 8.1 HighSeptember 17, 2020
• com.fasterxml.jackson.core:jackson-databind Root Code Injection in jackson-databind CVE-2020-24616 Public exploitFix available 8.1 HighAugust 25, 2020
• com.fasterxml.jackson.core:jackson-databind Root Deserialization of untrusted data in Jackson Databind CVE-2020-14061 Fix available 8.1 HighJune 14, 2020
• com.fasterxml.jackson.core:jackson-databind Root Deserialization of untrusted data in Jackson Databind CVE-2020-14062 Fix available 8.1 HighJune 14, 2020
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11113 Public exploitFix available 8.8 HighMarch 31, 2020
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-10673 Public exploitFix available 8.8 HighMarch 18, 2020
• com.fasterxml.jackson.core:jackson-databind Root Polymorphic deserialization of malicious object in jackson-databind CVE-2019-14893 Fix available 7.5 HighMarch 2, 2020
• com.fasterxml.jackson.core:jackson-databind Root Polymorphic deserialization of malicious object in jackson-databind CVE-2019-14892 Fix available 7.5 HighMarch 2, 2020
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-9547 Public exploitFix available EPSS 18.4% 9.8 CriticalMarch 2, 2020
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-9548 Public exploitFix available EPSS 18.9% 9.8 CriticalMarch 2, 2020
• com.fasterxml.jackson.core:jackson-databind Root Deserialization of Untrusted Data in jackson-databind CVE-2020-8840 Public exploitFix available EPSS 26.6% 9.8 CriticalFebruary 10, 2020
• com.fasterxml.jackson.core:jackson-databind Root Deserialization of Untrusted Data in jackson-databind CVE-2019-20330 Fix available 9.8 CriticalJanuary 3, 2020
• com.fasterxml.jackson.core:jackson-databind Root jackson-databind polymorphic typing issue CVE-2019-17531 Fix available 9.8 CriticalOctober 12, 2019
• Show olderLoading…