jackson-databind vulnerabilities (Ubuntu)

86 vulnerabilities.

• jackson-databind Ubuntu jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) CVE-2026-110879 Fix available 9.8 CriticalOctober 28, 2026
• jackson-databind Ubuntu jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVE-2026-91777 Fix available 7.5 HighSeptember 23, 2026
• jackson-databind Ubuntu jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVE-2026-91776 Fix available 7.5 HighSeptember 23, 2026
• jackson-databind Ubuntu jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service CVE-2026-68497 Fix available 7.5 HighSeptember 11, 2026
• jackson-databind Ubuntu jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types CVE-2026-83557 Fix available 5.6 MediumSeptember 1, 2026
• jackson-databind Ubuntu jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) CVE-2026-77310 Fix available 5.3 MediumAugust 24, 2026
• jackson-databind Ubuntu jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization CVE-2026-59889 Fix available 6.5 MediumJuly 14, 2026
• jackson-databind Ubuntu jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy CVE-2026-59888 Fix available 6.5 MediumJuly 14, 2026
• jackson-databind Ubuntu jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind CVE-2026-54518 Fix available 6.5 MediumJune 23, 2026
• jackson-databind Ubuntu jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() CVE-2026-50193 Fix available 6.3 MediumJune 23, 2026
• jackson-databind Ubuntu jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation CVE-2026-54512 Public exploitFix available 8.1 HighJune 23, 2026
• jackson-databind Ubuntu jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) CVE-2026-54513 Fix available 8.1 HighJune 23, 2026
• jackson-databind Ubuntu jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) CVE-2026-54514 Fix available 5.3 MediumJune 23, 2026
• jackson-databind Ubuntu jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties CVE-2026-54515 Public exploitFix available 5.3 MediumJune 23, 2026
• jackson-databind Ubuntu jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields CVE-2026-54516 Fix available 5.3 MediumJune 23, 2026
• jackson-databind Ubuntu jackson-databind: @JsonView bypass for setterless creator properties CVE-2026-54517 Fix available 5.3 MediumJune 23, 2026
• jackson-databind Ubuntu jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode CVE-2021-46877 Fix available 7.5 HighMarch 18, 2023
• jackson-databind Ubuntu Uncontrolled Resource Consumption in FasterXML jackson-databind CVE-2022-42004 Fix available 7.5 HighOctober 2, 2022
• jackson-databind Ubuntu Uncontrolled Resource Consumption in Jackson-databind CVE-2022-42003 Fix available 7.5 HighOctober 2, 2022
• jackson-databind Ubuntu Deeply nested json in jackson-databind CVE-2020-36518 Public exploitFix available 7.5 HighMarch 11, 2022
• jackson-databind Ubuntu jackson-databind vulnerable to unsafe deserialization CVE-2020-10650 Fix available 8.1 HighApril 7, 2021
• jackson-databind Ubuntu Deserialization of untrusted data in jackson-databind CVE-2021-20190 Fix available 8.1 HighJanuary 19, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36179 Public exploitFix available EPSS 17.1% 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36180 Public exploitFix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36182 Fix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36183 Fix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36184 Public exploitFix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36185 Fix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36186 Fix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36187 Fix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36188 Public exploitFix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36189 Fix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-36181 Fix available 8.1 HighJanuary 6, 2021
• jackson-databind Ubuntu Serialization gadget exploit in jackson-databind CVE-2020-35728 Public exploitFix available EPSS 12.5% 8.1 HighDecember 27, 2020
• jackson-databind Ubuntu Serialization gadgets exploit in jackson-databind CVE-2020-35490 Fix available 8.1 HighDecember 17, 2020
• jackson-databind Ubuntu Serialization gadgets exploit in jackson-databind CVE-2020-35491 Fix available 8.1 HighDecember 17, 2020
• jackson-databind Ubuntu XML External Entity (XXE) Injection in Jackson Databind CVE-2020-25649 Fix available EPSS 17.7% 7.5 HighOctober 14, 2020
• jackson-databind Ubuntu Unsafe Deserialization in jackson-databind CVE-2020-24750 Public exploitFix available 8.1 HighSeptember 17, 2020
• jackson-databind Ubuntu Code Injection in jackson-databind CVE-2020-24616 Public exploitFix available 8.1 HighAugust 25, 2020
• jackson-databind Ubuntu Deserialization of untrusted data in Jackson Databind CVE-2020-14195 Public exploitFix available 8.1 HighJune 16, 2020
• jackson-databind Ubuntu Deserialization of untrusted data in Jackson Databind CVE-2020-14060 Fix available 8.1 HighJune 14, 2020
• jackson-databind Ubuntu Deserialization of untrusted data in Jackson Databind CVE-2020-14061 Fix available 8.1 HighJune 14, 2020
• jackson-databind Ubuntu Deserialization of untrusted data in Jackson Databind CVE-2020-14062 Fix available 8.1 HighJune 14, 2020
• jackson-databind Ubuntu jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11620 Fix available 8.1 HighApril 7, 2020
• jackson-databind Ubuntu jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11619 Fix available 8.1 HighApril 7, 2020
• jackson-databind Ubuntu jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11111 Fix available 8.8 HighMarch 31, 2020
• jackson-databind Ubuntu jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11112 Fix available 8.8 HighMarch 31, 2020
• jackson-databind Ubuntu jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11113 Public exploitFix available 8.8 HighMarch 31, 2020
• jackson-databind Ubuntu jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-10968 Fix available 8.8 HighMarch 26, 2020
• jackson-databind Ubuntu jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-10969 Fix available 8.8 HighMarch 26, 2020
• Show olderLoading…