io.root.com.fasterxml.jackson.core:jackson-databind vulnerabilities (Root)
68 vulnerabilities.
-
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: quadratic forward-reference completion in Collection and Map deserializers 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types 5.6 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path 5.3 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) 5.3 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization 6.5 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy 6.5 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind 6.5 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() 6.3 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) 5.3 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties 5.3 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields 5.3 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind: @JsonView bypass for setterless creator properties 5.3 Medium -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Uncontrolled Resource Consumption in FasterXML jackson-databind 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Uncontrolled Resource Consumption in Jackson-databind 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Deeply nested json in jackson-databind 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind vulnerable to unsafe deserialization 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Deserialization of untrusted data in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Serialization gadget exploit in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Serialization gadgets exploit in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Serialization gadgets exploit in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot XML External Entity (XXE) Injection in Jackson Databind 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Unsafe Deserialization in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Code Injection in jackson-databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Deserialization of untrusted data in Jackson Databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Deserialization of untrusted data in Jackson Databind 8.1 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind mishandles the interaction between serialization gadgets and typing 8.8 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind mishandles the interaction between serialization gadgets and typing 8.8 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Polymorphic deserialization of malicious object in jackson-databind 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Polymorphic deserialization of malicious object in jackson-databind 7.5 High -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind mishandles the interaction between serialization gadgets and typing 9.8 Critical -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind mishandles the interaction between serialization gadgets and typing 9.8 Critical -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Deserialization of Untrusted Data in jackson-databind 9.8 Critical -
io.root.com.fasterxml.jackson.core:jackson-databindRoot Deserialization of Untrusted Data in jackson-databind 9.8 Critical -
io.root.com.fasterxml.jackson.core:jackson-databindRoot jackson-databind polymorphic typing issue 9.8 Critical - Show olderLoading…