Fasterxml Jackson-databind vulnerabilities

• fasterxml jackson-databind jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) CVE-2026-110879 Fix available 9.8 CriticalOctober 28, 2026
• fasterxml jackson-databind jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVE-2026-91777 Fix available 7.5 HighSeptember 23, 2026
• fasterxml jackson-databind jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVE-2026-91776 Fix available 7.5 HighSeptember 23, 2026
• fasterxml jackson-databind jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service CVE-2026-68497 Fix available 7.5 HighSeptember 11, 2026
• fasterxml jackson-databind jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types CVE-2026-83557 Fix available 5.6 MediumSeptember 1, 2026
• fasterxml jackson-databind jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path CVE-2026-19032 Fix available 5.3 MediumSeptember 1, 2026
• fasterxml com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind +1 more jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) CVE-2026-77310 Fix available 5.3 MediumAugust 24, 2026
• fasterxml jackson-databind jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization CVE-2026-59889 Fix available 6.5 MediumJuly 14, 2026
• fasterxml jackson-databind jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy CVE-2026-59888 Fix available 6.5 MediumJuly 14, 2026
• fasterxml jackson-databind jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind CVE-2026-54518 Fix available 6.5 MediumJune 23, 2026
• fasterxml jackson-databind jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() CVE-2026-50193 Fix available 6.3 MediumJune 23, 2026
• fasterxml jackson-databind jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation CVE-2026-54512 Public exploitFix available 8.1 HighJune 23, 2026
• fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 more jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) CVE-2026-54513 Fix available 8.1 HighJune 23, 2026
• fasterxml jackson-databind jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) CVE-2026-54514 Fix available 5.3 MediumJune 23, 2026
• fasterxml jackson-databind jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties CVE-2026-54515 Public exploitFix available 5.3 MediumJune 23, 2026
• fasterxml jackson-databind jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields CVE-2026-54516 Fix available 5.3 MediumJune 23, 2026
• fasterxml jackson-databind jackson-databind: @JsonView bypass for setterless creator properties CVE-2026-54517 Fix available 5.3 MediumJune 23, 2026
• fasterxml jackson-databind An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of... CVE-2023-35116 Disputed 4.7 MediumJune 14, 2023
• fasterxml jackson-databind jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode CVE-2021-46877 Fix available 7.5 HighMarch 18, 2023
• fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +1 more +3 more Uncontrolled Resource Consumption in FasterXML jackson-databind CVE-2022-42004 Fix available 7.5 HighOctober 2, 2022
• fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +1 more +3 more Uncontrolled Resource Consumption in Jackson-databind CVE-2022-42003 Fix available 7.5 HighOctober 2, 2022
• fasterxml jackson-databind, debian linux, netapp active iq unified manager +33 more +35 more Deeply nested json in jackson-databind CVE-2020-36518 Public exploitFix available 7.5 HighMarch 11, 2022
• fasterxml jackson-databind, debian linux, netapp active iq unified manager +2 more +4 more jackson-databind vulnerable to unsafe deserialization CVE-2020-10650 Fix available 8.1 HighApril 7, 2021
• fasterxml jackson-databind, apache nifi, debian linux +6 more +8 more Deserialization of untrusted data in jackson-databind CVE-2021-20190 Fix available 8.1 HighJanuary 19, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +54 more +56 more Unsafe Deserialization in jackson-databind CVE-2020-36179 Public exploitFix available EPSS 17.1% 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +56 more +58 more Unsafe Deserialization in jackson-databind CVE-2020-36180 Public exploitFix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +56 more +58 more Unsafe Deserialization in jackson-databind CVE-2020-36182 Fix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more Unsafe Deserialization in jackson-databind CVE-2020-36183 Fix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +56 more +58 more Unsafe Deserialization in jackson-databind CVE-2020-36184 Public exploitFix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more Unsafe Deserialization in jackson-databind CVE-2020-36185 Fix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more Unsafe Deserialization in jackson-databind CVE-2020-36186 Fix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more Unsafe Deserialization in jackson-databind CVE-2020-36187 Fix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 more Unsafe Deserialization in jackson-databind CVE-2020-36188 Public exploitFix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp cloud backup +37 more +39 more Unsafe Deserialization in jackson-databind CVE-2020-36189 Fix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp service level manager +55 more +57 more Unsafe Deserialization in jackson-databind CVE-2020-36181 Fix available 8.1 HighJanuary 6, 2021
• fasterxml jackson-databind, debian linux, netapp service level manager +37 more +39 more Serialization gadget exploit in jackson-databind CVE-2020-35728 Public exploitFix available EPSS 12.5% 8.1 HighDecember 27, 2020
• fasterxml jackson-databind, debian linux, netapp service level manager +22 more +24 more Serialization gadgets exploit in jackson-databind CVE-2020-35490 Fix available 8.1 HighDecember 17, 2020
• fasterxml jackson-databind, debian linux, netapp service level manager +23 more +25 more Serialization gadgets exploit in jackson-databind CVE-2020-35491 Fix available 8.1 HighDecember 17, 2020
• apache iotdb, fasterxml jackson-databind, fedoraproject fedora +36 more +38 more XML External Entity (XXE) Injection in Jackson Databind CVE-2020-25649 Fix available EPSS 17.7% 7.5 HighOctober 14, 2020
• fasterxml jackson-databind, debian linux, oracle agile product lifecycle management +23 more +25 more Unsafe Deserialization in jackson-databind CVE-2020-24750 Public exploitFix available 8.1 HighSeptember 17, 2020
• fasterxml jackson-databind, debian linux, netapp active iq unified manager +22 more +24 more Code Injection in jackson-databind CVE-2020-24616 Public exploitFix available 8.1 HighAugust 25, 2020
• fasterxml jackson-databind, debian linux, netapp active iq unified manager +11 more +13 more Deserialization of untrusted data in Jackson Databind CVE-2020-14195 Public exploitFix available 8.1 HighJune 16, 2020
• fasterxml jackson-databind, netapp active iq unified manager, steelstore cloud integrated storage +9 more +11 more Deserialization of untrusted data in Jackson Databind CVE-2020-14060 Fix available 8.1 HighJune 14, 2020
• fasterxml jackson-databind, debian linux, netapp active iq unified manager +12 more +14 more Deserialization of untrusted data in Jackson Databind CVE-2020-14061 Fix available 8.1 HighJune 14, 2020
• fasterxml jackson-databind, debian linux, netapp active iq unified manager +10 more +12 more Deserialization of untrusted data in Jackson Databind CVE-2020-14062 Fix available 8.1 HighJune 14, 2020
• fasterxml jackson-databind, debian linux, netapp active iq unified manager +15 more +17 more jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11620 Fix available 8.1 HighApril 7, 2020
• fasterxml jackson-databind, debian linux, netapp active iq unified manager +18 more +20 more jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11619 Fix available 8.1 HighApril 7, 2020
• fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +29 more +31 more jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11111 Fix available 8.8 HighMarch 31, 2020
• fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +29 more +31 more jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11112 Fix available 8.8 HighMarch 31, 2020
• fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +30 more +32 more jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11113 Public exploitFix available 8.8 HighMarch 31, 2020
• Show olderLoading…