VulnerableCode Package Details - pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.6

Vulnerabilities affecting this package (20)

Advisory	Summary	Fixed in package version
GHSA-rgv9-q543-rqg4 Aliases: CVE-2022-42004	Uncontrolled Resource Consumption in FasterXML jackson-databind In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur …	2.12.7.1 Vulnerable
GHSA-jjjh-jjxp-wpff Aliases: CVE-2022-42003	Uncontrolled Resource Consumption in Jackson-databind In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur …	2.12.7.1 Vulnerable
GHSA-5jmj-h7xm-6q6v Aliases: CVE-2026-54515	jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties ## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a …	2.18.9 Vulnerable 2.18.9 Vulnerable
GHSA-hgj6-7826-r7m5 Aliases: CVE-2026-54514	jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager …	2.18.8 Vulnerable 2.18.8 Vulnerable
CVE-2020-36518 Aliases: GHSA-57j2-w4cx-62h2	Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of …	2.13.2.1 Vulnerable 2.12.6.1 Vulnerable 2.13.2.1 Vulnerable 2.12.6.1 Vulnerable
CVE-2026-50193 Aliases: GHSA-3wrr-7qpf-2prh	jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) …	2.14.0 Vulnerable
GHSA-rmj7-2vxq-3g9f Aliases: CVE-2026-54513	jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) ## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on …	2.18.8 Vulnerable 2.18.8 Vulnerable 2.18.8 Vulnerable 2.18.8 Vulnerable 2.18.8 Vulnerable 2.18.8 Vulnerable 2.18.8 Vulnerable
GHSA-57j2-w4cx-62h2 Aliases: CVE-2020-36518	Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack …	2.13.2.1 Vulnerable 2.12.6.1 Vulnerable 2.12.6.1 Vulnerable
GHSA-3wrr-7qpf-2prh Aliases: CVE-2026-50193	jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() ### Impact Potential Denial-of-Service when attacker sends deeply nested JSON if (and …	2.14.0 Vulnerable 2.14.0 Vulnerable 2.14.0 Vulnerable
GHSA-j3rv-43j4-c7qm Aliases: CVE-2026-54512	jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation `jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary …	2.18.8 Vulnerable 2.21.4 Vulnerable 2.18.8 Vulnerable 2.21.4 Vulnerable 2.18.8 Vulnerable
GHSA-wjgm-6hv5-3cvf Aliases: CVE-2026-19032	jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution ### Summary A `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. …	2.18.10 Vulnerable
GHSA-wv8q-qhhj-9h54 Aliases: CVE-2026-91776	jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw …	2.18.11 Not vulnerable
GHSA-vvgp-rfg2-7rr6 Aliases: CVE-2026-77310	jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an …	2.18.9 Vulnerable
GHSA-cxp5-3px4-pw24 Aliases: CVE-2026-91777	jackson-databind quadratic forward-reference completion ### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later …	2.18.11 Not vulnerable
GHSA-gx83-3vf8-gh7j Aliases: CVE-2026-83557	jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) ### Summary `DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever …	2.18.10 Vulnerable
GHSA-5gvw-p9qm-jgwh Aliases: CVE-2026-59889	jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property …	2.18.9 Vulnerable 2.18.9 Vulnerable 2.18.9 Vulnerable
CVE-2026-54515 Aliases: GHSA-5jmj-h7xm-6q6v	jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer …	2.18.9 Vulnerable 2.21.5 Vulnerable 2.22.1 Vulnerable 2.18.9 Vulnerable 2.21.5 Vulnerable 2.22.1 Vulnerable
CVE-2026-54514 Aliases: GHSA-hgj6-7826-r7m5	jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name …	2.18.8 Vulnerable 2.21.4 Vulnerable 2.18.8 Vulnerable 2.21.4 Vulnerable
CVE-2026-54512 Aliases: GHSA-j3rv-43j4-c7qm	jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation `jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary …	2.18.8 Vulnerable 2.21.4 Vulnerable 2.18.8 Vulnerable 2.21.4 Vulnerable
CVE-2026-54513 Aliases: GHSA-rmj7-2vxq-3g9f	jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without …	2.18.8 Vulnerable 2.21.4 Vulnerable 2.18.8 Vulnerable 2.21.4 Vulnerable 2.18.8 Vulnerable 2.21.4 Vulnerable 2.18.8 Vulnerable 2.21.4 Vulnerable

Next non-vulnerable version	2.18.11
Latest non-vulnerable version	2.22.3
Risk score	3.7