Skip to content
Fasterxml vulnerabilities
Newest
-
fasterxml jackson-databind
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
CVE-2026-110879
Fix available
9.8 Critical
-
fasterxml jackson-dataformat-protobuf
jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
CVE-2026-110747
Fix available
7.5 High
-
fasterxml jackson-dataformat-smile
jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
CVE-2026-104895
7.5 High
-
fasterxml jackson-dataformat-protobuf
jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError
CVE-2026-104016
Fix available
7.5 High
-
fasterxml jackson-core
jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service
CVE-2026-68498
Fix available
7.5 High
-
fasterxml jackson-dataformats-binary
jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
CVE-2026-68496
Fix available
7.5 High
-
fasterxml jackson-dataformats-binary
jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
CVE-2026-68495
Fix available
7.5 High
-
fasterxml jackson-databind
jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
CVE-2026-91777
Fix available
7.5 High
-
fasterxml jackson-databind
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
CVE-2026-91776
Fix available
7.5 High
-
fasterxml jackson-core
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth
CVE-2026-89425
Fix available
7.5 High
-
fasterxml jackson-core
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
CVE-2026-89407
Fix available
7.5 High
-
fasterxml jackson-databind
jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
CVE-2026-68497
Fix available
7.5 High
-
fasterxml jackson-databind
jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
CVE-2026-83557
Fix available
5.6 Medium
-
fasterxml jackson-databind
jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
CVE-2026-19032
Fix available
5.3 Medium
-
fasterxml com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind +1 more
jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
CVE-2026-77310
Fix available
5.3 Medium
-
fasterxml jackson-core
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
CVE-2026-68494
Fix available
8.7 High
-
fasterxml jackson-databind
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
CVE-2026-59889
Fix available
6.5 Medium
-
fasterxml jackson-databind
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
CVE-2026-59888
Fix available
6.5 Medium
-
fasterxml jackson-databind
jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind
CVE-2026-54518
Fix available
6.5 Medium
-
fasterxml jackson-databind
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
CVE-2026-50193
Fix available
6.3 Medium
-
fasterxml jackson-databind
jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
CVE-2026-54512
Public exploitFix available
8.1 High
-
fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 more
jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
CVE-2026-54513
Fix available
8.1 High
-
fasterxml jackson-databind
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
CVE-2026-54514
Fix available
5.3 Medium
-
fasterxml jackson-databind
jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
CVE-2026-54515
Public exploitFix available
5.3 Medium
-
fasterxml jackson-databind
jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields
CVE-2026-54516
Fix available
5.3 Medium
-
fasterxml jackson-databind
jackson-databind: @JsonView bypass for setterless creator properties
CVE-2026-54517
Fix available
5.3 Medium
-
fasterxml jackson-core, red hat certificate system 10, enterprise linux 10 +2 more +4 more
jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
CVE-2026-29062
Fix available
8.7 High
-
fasterxml jackson-core
jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service
CVE-2026-18401
Fix available
6.9 Medium
-
fasterxml jackson-core
jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data
CVE-2025-52999
Public exploitFix available
8.7 High
-
fasterxml jackson-core
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation
CVE-2025-49128
Fix available
4.0 Medium
-
fasterxml jackson-dataformats-text
DOS in jackson-dataformats-text
CVE-2023-3894
Fix available
5.8 Medium
-
fasterxml jackson-databind
An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of...
CVE-2023-35116
Fix availableDisputed
4.7 Medium
-
fasterxml jackson-databind
jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
CVE-2021-46877
Fix available
7.5 High
-
fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +1 more +3 more
Uncontrolled Resource Consumption in FasterXML jackson-databind
CVE-2022-42004
Fix available
7.5 High
-
fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +1 more +3 more
Uncontrolled Resource Consumption in Jackson-databind
CVE-2022-42003
Fix available
7.5 High
-
fasterxml woodstox, xstream +1 more
Stack Buffer Overflow in Woodstox
CVE-2022-40152
Fix available
EPSS 18.2%
6.5 Medium
-
fasterxml jackson-databind, debian linux, netapp active iq unified manager +33 more +35 more
Deeply nested json in jackson-databind
CVE-2020-36518
Public exploitFix available
7.5 High
-
fasterxml jackson-databind, debian linux, netapp active iq unified manager +2 more +4 more
jackson-databind vulnerable to unsafe deserialization
CVE-2020-10650
Fix available
8.1 High
-
fasterxml jackson-dataformats-binary, oracle weblogic server, quarkus +2 more
Denial of Service (DoS)
CVE-2020-28491
Fix available
7.5 High
-
fasterxml jackson-databind, apache nifi, debian linux +6 more +8 more
Deserialization of untrusted data in jackson-databind
CVE-2021-20190
Fix available
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +54 more +56 more
Unsafe Deserialization in jackson-databind
CVE-2020-36179
Public exploitFix available
EPSS 17.1%
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +56 more +58 more
Unsafe Deserialization in jackson-databind
CVE-2020-36180
Public exploitFix available
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +56 more +58 more
Unsafe Deserialization in jackson-databind
CVE-2020-36182
Fix available
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more
Unsafe Deserialization in jackson-databind
CVE-2020-36183
Fix available
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +56 more +58 more
Unsafe Deserialization in jackson-databind
CVE-2020-36184
Public exploitFix available
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more
Unsafe Deserialization in jackson-databind
CVE-2020-36185
Fix available
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more
Unsafe Deserialization in jackson-databind
CVE-2020-36186
Fix available
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more
Unsafe Deserialization in jackson-databind
CVE-2020-36187
Fix available
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more
Unsafe Deserialization in jackson-databind
CVE-2020-36188
Public exploitFix available
8.1 High
-
fasterxml jackson-databind, debian linux, netapp cloud backup +37 more +39 more
Unsafe Deserialization in jackson-databind
CVE-2020-36189
Fix available
8.1 High
- Show olderLoading…