Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.0
purl pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.0
Tags Ghost
Next non-vulnerable version 2.12.7.1
Latest non-vulnerable version 2.16.0
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-w51e-ntqd-8bbg
Aliases:
CVE-2020-25649
GHSA-288c-cq4h-88gq
XML External Entity (XXE) Injection in Jackson Databind A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
2.10.5.1
Affected by 4 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-02T16:56:11.009264+00:00 GHSA Importer Affected by VCID-w51e-ntqd-8bbg https://github.com/advisories/GHSA-288c-cq4h-88gq 38.1.0