tools.jackson.core:jackson-databind vulnerabilities (TuxCare)
10 vulnerabilities.
-
tools.jackson.core:jackson-databindTuxCare jackson-databind: quadratic forward-reference completion in Collection and Map deserializers 7.5 High -
tools.jackson.core:jackson-databindTuxCare jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID 7.5 High -
tools.jackson.core:jackson-databindTuxCare jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path 5.3 Medium -
tools.jackson.core:jackson-databindTuxCare jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) 5.3 Medium -
tools.jackson.core:jackson-databindTuxCare jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization 6.5 Medium -
tools.jackson.core:jackson-databindTuxCare jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy 6.5 Medium -
tools.jackson.core:jackson-databindTuxCare jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind 6.5 Medium -
tools.jackson.core:jackson-databindTuxCare jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) 5.3 Medium -
tools.jackson.core:jackson-databindTuxCare jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties 5.3 Medium -
tools.jackson.core:jackson-databindTuxCare jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields 5.3 Medium