Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.5
purl pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.5
Next non-vulnerable version 2.18.11
Latest non-vulnerable version 2.22.3
Risk score 4.4
Vulnerabilities affecting this package (39)
Advisory Summary Fixed in package version
GHSA-rfx6-vp9g-rh7v
Aliases:
CVE-2017-17485
jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass FasterXML jackson-databind through 2.8.10 and 2.9.x through …
2.7.9.2
Vulnerable
GHSA-v585-23hc-c647
Aliases:
CVE-2020-36186
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-r695-7vr9-jgc2
Aliases:
CVE-2020-36187
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
2.9.10.8
Vulnerable
GHSA-m6x4-97wx-4q27
Aliases:
CVE-2020-36184
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
2.9.10.8
Vulnerable
GHSA-8w26-6f25-cm9x
Aliases:
CVE-2020-36185
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-rgv9-q543-rqg4
Aliases:
CVE-2022-42004
Uncontrolled Resource Consumption in FasterXML jackson-databind In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-jjjh-jjxp-wpff
Aliases:
CVE-2022-42003
Uncontrolled Resource Consumption in Jackson-databind In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-rpr3-cw39-3pxh
Aliases:
CVE-2020-10650
GMS-2022-2955
jackson-databind vulnerable to unsafe deserialization The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling …
2.9.10.4
Vulnerable
GHSA-6fpp-rgj9-8rwc
Aliases:
CVE-2019-14379
Deserialization of untrusted data in FasterXML jackson-databind SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when …
2.7.9.6
Vulnerable
GHSA-f3j5-rmmp-3fc5
Aliases:
CVE-2019-17267
Improper Input Validation in jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 and 2.8.11.5. It is …
2.8.11.5
Vulnerable
GHSA-q93h-jc49-78gg
Aliases:
CVE-2020-9547
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.7.9.7
Vulnerable
GHSA-p43x-xfjf-5jhr
Aliases:
CVE-2020-9548
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.7.9.7
Vulnerable
CVE-2019-14540

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariConfig`.
2.9.10
Vulnerable
CVE-2019-16942

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2019-16335

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariDataSource`. This is a …
2.9.10
Vulnerable
CVE-2019-17531

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2019-16943

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2019-14893

Deserialization of Untrusted Data A flaw was discovered in FasterXML jackson-databind that permits polymorphic deserialization of malicious objects. Specifically when …
2.8.11.5
Vulnerable
2.9.10
Vulnerable
CVE-2019-17267

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`.
2.9.10
Vulnerable
GHSA-hgj6-7826-r7m5
Aliases:
CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager …
2.18.8
Vulnerable
2.18.8
Vulnerable
CVE-2019-20330
Aliases:
GHSA-gww7-p5w4-wrfv
Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
CVE-2017-15095

Deserialization of Untrusted Data A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform …
2.7.9.2
Vulnerable
2.8.10
Vulnerable
2.9.1
Vulnerable
2.7.9.2
Vulnerable
2.8.10
Vulnerable
2.9.1
Vulnerable
CVE-2018-7489

Deserialization of Untrusted Data FasterXML jackson-databind allows unauthenticated remote code execution. This is exploitable by sending maliciously crafted JSON input …
2.7.9.3
Vulnerable
2.8.11.1
Vulnerable
2.9.5
Vulnerable
2.7.9.3
Vulnerable
2.8.11.1
Vulnerable
2.9.5
Vulnerable
CVE-2020-36518
Aliases:
GHSA-57j2-w4cx-62h2
Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
CVE-2018-1000873

Improper Input Validation Fasterxml Jackson does not properly validate user input leading to a DoS. Specifically, deserializing malicious input of …
2.9.8
Vulnerable
2.9.8
Vulnerable
GHSA-r3gr-cxrf-hg25
Aliases:
CVE-2020-35491
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-5r5r-6hpj-8gg9
Aliases:
CVE-2020-35728
Serialization gadget exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-wh8g-3j2c-rqj5
Aliases:
CVE-2020-35490
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-h3cw-g4mq-c5x2
Aliases:
CVE-2020-24616
Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x …
2.9.10.6
Vulnerable
2.9.10.6
Vulnerable
GHSA-57j2-w4cx-62h2
Aliases:
CVE-2020-36518
Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.12.6.1
Vulnerable
GHSA-qr7j-h6gg-jmgc
Aliases:
CVE-2018-11307
Deserialization of Untrusted Data in jackson-databind An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default …
2.7.9.4
Vulnerable
2.8.11.2
Vulnerable
2.7.9.4
Vulnerable
GHSA-cjjf-94ff-43w7
Aliases:
CVE-2018-12022
jackson-databind Deserialization of Untrusted Data vulnerability An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When …
2.7.9.4
Vulnerable
2.8.11.2
Vulnerable
2.7.9.4
Vulnerable
2.8.11.2
Vulnerable
2.7.9.4
Vulnerable
GHSA-4gq5-ch57-c2mg
Aliases:
CVE-2018-14719
Arbitrary Code Execution in jackson-databind FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary …
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.7.9.5
Vulnerable
GHSA-wv8q-qhhj-9h54
Aliases:
CVE-2026-91776
jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw …
2.18.11
Not vulnerable
GHSA-vvgp-rfg2-7rr6
Aliases:
CVE-2026-77310
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an …
2.18.9
Vulnerable
GHSA-cxp5-3px4-pw24
Aliases:
CVE-2026-91777
jackson-databind quadratic forward-reference completion ### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later …
2.18.11
Not vulnerable
GHSA-w3f4-3q6j-rh82
Aliases:
CVE-2018-5968
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because …
2.8.11.1
Vulnerable
2.7.9.5
Vulnerable
2.7.9.5
Vulnerable
GHSA-5gvw-p9qm-jgwh
Aliases:
CVE-2026-59889
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property …
2.18.9
Vulnerable
2.18.9
Vulnerable
2.18.9
Vulnerable
CVE-2026-54514
Aliases:
GHSA-hgj6-7826-r7m5
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name …
2.18.8
Vulnerable
2.21.4
Vulnerable
2.18.8
Vulnerable
2.21.4
Vulnerable
Vulnerabilities fixed by this package (19)

Advisory Summary Aliases
GHSA-89qr-369f-5m5x
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … CVE-2020-36182
GHSA-vfqx-33qm-g869
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … CVE-2020-36189
GHSA-f9xh-2qgp-cq57
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … CVE-2020-36188
GHSA-8c4j-34r4-xr8g
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … CVE-2020-36180
GHSA-9m6f-7xcq-8vf8
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … CVE-2020-36183
GHSA-cvm9-fjm9-3572
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … CVE-2020-36181
GHSA-9gph-22xh-8x98
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … CVE-2020-36179
GHSA-5949-rw7g-wx7w
Deserialization of untrusted data in jackson-databind A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction … CVE-2021-20190
CVE-2020-36187
Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource`.
CVE-2020-36188
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … GHSA-f9xh-2qgp-cq57
CVE-2020-36181
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … GHSA-cvm9-fjm9-3572
CVE-2021-20190
Deserialization of untrusted data in jackson-databind A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction … GHSA-5949-rw7g-wx7w
CVE-2020-36182
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … GHSA-89qr-369f-5m5x
CVE-2020-36183
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … GHSA-9m6f-7xcq-8vf8
CVE-2020-36189
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … GHSA-vfqx-33qm-g869
CVE-2020-36180
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … GHSA-8c4j-34r4-xr8g
CVE-2020-36179
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … GHSA-9gph-22xh-8x98
GHSA-cggj-fvv3-cqwv
FasterXML jackson-databind allows unauthenticated remote code execution FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x … CVE-2018-7489
GHSA-qjw2-hr98-qgfh
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets … CVE-2020-24750