tools.jackson.core:jackson-databind vulnerabilities (Root)

14 vulnerabilities.

• tools.jackson.core:jackson-databind Root jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVE-2026-91777 Fix available 7.5 HighSeptember 23, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVE-2026-91776 Fix available 7.5 HighSeptember 23, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service CVE-2026-68497 Fix available 7.5 HighSeptember 11, 2026
• tools.jackson.core:jackson-databind Root jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types CVE-2026-83557 Fix available 5.6 MediumSeptember 1, 2026
• tools.jackson.core:jackson-databind Root jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path CVE-2026-19032 Fix available 5.3 MediumSeptember 1, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) CVE-2026-77310 Fix available 5.3 MediumAugust 24, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy CVE-2026-59888 Fix available 6.5 MediumJuly 14, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind CVE-2026-54518 Fix available 6.5 MediumJune 23, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation CVE-2026-54512 Public exploitFix available 8.1 HighJune 23, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) CVE-2026-54513 Fix available 8.1 HighJune 23, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) CVE-2026-54514 Fix available 5.3 MediumJune 23, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties CVE-2026-54515 Public exploitFix available 5.3 MediumJune 23, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields CVE-2026-54516 Fix available 5.3 MediumJune 23, 2026
• tools.jackson.core:jackson-databind Root jackson-databind: @JsonView bypass for setterless creator properties CVE-2026-54517 Fix available 5.3 MediumJune 23, 2026