jackson-databind vulnerabilities (SUSE)
25 vulnerabilities.
-
jackson-databindSUSE jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service 7.5 High -
jackson-databindSUSE jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service 7.5 High -
jackson-databindSUSE jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service 7.5 High -
jackson-databindSUSE jackson-databind: quadratic forward-reference completion in Collection and Map deserializers 7.5 High -
jackson-databindSUSE jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID 7.5 High -
jackson-databindSUSE jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth 7.5 High -
jackson-databindSUSE jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS 7.5 High -
jackson-databindSUSE jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service 7.5 High -
jackson-databindSUSE jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types 5.6 Medium -
jackson-databindSUSE jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path 5.3 Medium -
jackson-databindSUSE jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) 8.7 High -
jackson-databindSUSE jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization 6.5 Medium -
jackson-databindSUSE jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy 6.5 Medium -
jackson-databindSUSE jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation 8.1 High -
jackson-databindSUSE jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) 8.1 High -
jackson-databindSUSE jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) 5.3 Medium -
jackson-databindSUSE jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties 5.3 Medium -
jackson-databindSUSE jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service 6.9 Medium -
jackson-databindSUSE Uncontrolled Resource Consumption in FasterXML jackson-databind 7.5 High -
jackson-databindSUSE Uncontrolled Resource Consumption in Jackson-databind 7.5 High -
jackson-databindSUSE Deeply nested json in jackson-databind 7.5 High -
jackson-databindSUSE Denial of Service (DoS) 7.5 High -
jackson-databindSUSE Deserialization of untrusted data in jackson-databind 8.1 High -
jackson-databindSUSE Serialization gadget exploit in jackson-databind 8.1 High -
jackson-databindSUSE XML External Entity (XXE) Injection in Jackson Databind 7.5 High