Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.1
purl pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.1
Next non-vulnerable version 2.18.11
Latest non-vulnerable version 2.22.3
Risk score 4.5
Vulnerabilities affecting this package (120)
Advisory Summary Fixed in package version
CVE-2020-10672

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2018-5968

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the …
2.7.9.5
Vulnerable
2.8.11.1
Vulnerable
2.8.11.2
Vulnerable
2.8.11.3
Vulnerable
2.9.4
Vulnerable
2.9.5
Vulnerable
2.9.6
Vulnerable
2.9.7
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
CVE-2018-19361

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class …
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
CVE-2019-12814

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or …
2.8.11.4
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2018-14718

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext …
2.6.7.2
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.8.11.4
Vulnerable
2.9.7
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
CVE-2018-14721

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to …
2.6.7.2
Vulnerable
2.6.7.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.8.11.4
Vulnerable
2.9.7
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2019-16943

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or …
2.8.11.5
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2020-10968

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2018-7489

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete …
2.7.9.3
Vulnerable
2.7.9.4
Vulnerable
2.7.9.5
Vulnerable
2.8.11.1
Vulnerable
2.8.11.2
Vulnerable
2.8.11.3
Vulnerable
2.8.11.4
Vulnerable
2.8.11.5
Vulnerable
2.8.11.6
Vulnerable
2.9.5
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.10.0.pr2
Vulnerable
2.10.2
Vulnerable
CVE-2018-19360

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class …
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
CVE-2020-10650

2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-12384

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the …
2.8.11.4
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2019-12086

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or …
2.8.11.4
Vulnerable
2.9.9
Vulnerable
CVE-2018-19362

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class …
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
CVE-2020-24750

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2020-10673

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-16942

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or …
2.8.11.5
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2018-11307

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class …
2.7.9.4
Vulnerable
2.7.9.5
Vulnerable
2.8.11.2
Vulnerable
2.8.11.3
Vulnerable
2.9.6
Vulnerable
2.9.7
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
CVE-2017-7525

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user …
2.8.10
Vulnerable
2.9.1
Vulnerable
2.9.2
Vulnerable
2.9.3
Vulnerable
2.9.4
Vulnerable
2.9.5
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.10.0.pr2
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-9546

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-9548

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2019-20330

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2018-14720

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block …
2.6.7.2
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.8.11.4
Vulnerable
2.9.7
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
2.9.10
Vulnerable
CVE-2018-12022

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally …
2.7.9.4
Vulnerable
2.7.9.5
Vulnerable
2.8.11.2
Vulnerable
2.8.11.3
Vulnerable
2.9.6
Vulnerable
2.9.7
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
CVE-2017-17485

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the …
2.7.9.2
Vulnerable
2.7.9.3
Vulnerable
2.7.9.4
Vulnerable
2.7.9.5
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.9.10.4
Vulnerable
2.10.0.pr2
Vulnerable
2.10.2
Vulnerable
CVE-2020-24616

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2018-12023

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally …
2.7.9.4
Vulnerable
2.7.9.5
Vulnerable
2.8.11.2
Vulnerable
2.8.11.3
Vulnerable
2.9.6
Vulnerable
2.9.7
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
CVE-2020-11113

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-14439

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either …
2.8.11.4
Vulnerable
2.8.11.5
Vulnerable
2.8.11.6
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
CVE-2019-14379

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code …
2.8.11.4
Vulnerable
2.8.11.5
Vulnerable
2.8.11.6
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-10969

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
2.8.11.6
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2018-14719

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt …
2.6.7.2
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.8.11.4
Vulnerable
2.9.7
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
2.9.10
Vulnerable
CVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2019-17531

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or …
2.8.11.5
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
CVE-2020-11111

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, …
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-11112

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-17267

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
2.8.11.5
Vulnerable
2.9.10
Vulnerable
2.10.0
Vulnerable
GHSA-rfx6-vp9g-rh7v
Aliases:
CVE-2017-17485
jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass FasterXML jackson-databind through 2.8.10 and 2.9.x through …
2.7.9.2
Vulnerable
GHSA-h592-38cm-4ggp
Aliases:
CVE-2017-15095
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution jackson-databind in versions prior to 2.8.11 and 2.9.4 contain …
2.7.9.2
Vulnerable
GHSA-v585-23hc-c647
Aliases:
CVE-2020-36186
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-89qr-369f-5m5x
Aliases:
CVE-2020-36182
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-vfqx-33qm-g869
Aliases:
CVE-2020-36189
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-r695-7vr9-jgc2
Aliases:
CVE-2020-36187
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
2.9.10.8
Vulnerable
GHSA-f9xh-2qgp-cq57
Aliases:
CVE-2020-36188
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-8c4j-34r4-xr8g
Aliases:
CVE-2020-36180
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-9m6f-7xcq-8vf8
Aliases:
CVE-2020-36183
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-cvm9-fjm9-3572
Aliases:
CVE-2020-36181
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-m6x4-97wx-4q27
Aliases:
CVE-2020-36184
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
2.9.10.8
Vulnerable
GHSA-9gph-22xh-8x98
Aliases:
CVE-2020-36179
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-8w26-6f25-cm9x
Aliases:
CVE-2020-36185
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-5949-rw7g-wx7w
Aliases:
CVE-2021-20190
Deserialization of untrusted data in jackson-databind A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction …
2.9.10.7
Vulnerable
GHSA-rgv9-q543-rqg4
Aliases:
CVE-2022-42004
Uncontrolled Resource Consumption in FasterXML jackson-databind In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-jjjh-jjxp-wpff
Aliases:
CVE-2022-42003
Uncontrolled Resource Consumption in Jackson-databind In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-rpr3-cw39-3pxh
Aliases:
CVE-2020-10650
GMS-2022-2955
jackson-databind vulnerable to unsafe deserialization The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling …
2.9.10.4
Vulnerable
GHSA-gjmw-vf9h-g25v
Aliases:
CVE-2019-17531
jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. …
2.8.11.5
Vulnerable
GHSA-fmmc-742q-jg75
Aliases:
CVE-2019-16943
jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. …
2.8.11.5
Vulnerable
GHSA-mx7p-6679-8g3q
Aliases:
CVE-2019-16942
Polymorphic Typing in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing …
2.8.11.5
Vulnerable
GHSA-5ww9-j83m-q7qx
Aliases:
CVE-2019-12086
Information exposure in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing …
2.7.9.6
Vulnerable
GHSA-mph4-vhrx-mv67
Aliases:
CVE-2019-12384
Deserialization of Untrusted Data in FasterXML jackson-databind FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of …
2.7.9.6
Vulnerable
GHSA-6fpp-rgj9-8rwc
Aliases:
CVE-2019-14379
Deserialization of untrusted data in FasterXML jackson-databind SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when …
2.7.9.6
Vulnerable
GHSA-gwp4-hfv6-p7hw
Aliases:
CVE-2019-14439
Deserialization of untrusted data in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.4, …
2.7.9.6
Vulnerable
GHSA-85cw-hj65-qqv9
Aliases:
CVE-2019-16335
Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. …
2.8.11.5
Vulnerable
GHSA-h822-r4r5-v8jg
Aliases:
CVE-2019-14540
Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. …
2.8.11.5
Vulnerable
GHSA-f3j5-rmmp-3fc5
Aliases:
CVE-2019-17267
Improper Input Validation in jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 and 2.8.11.5. It is …
2.8.11.5
Vulnerable
GHSA-fqwf-pjwf-7vqv
Aliases:
CVE-2020-10673
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 and 2.6.7.4 mishandles the interaction between …
2.9.10.4
Vulnerable
GHSA-q93h-jc49-78gg
Aliases:
CVE-2020-9547
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.7.9.7
Vulnerable
GHSA-p43x-xfjf-5jhr
Aliases:
CVE-2020-9548
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.7.9.7
Vulnerable
CVE-2019-14540

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariConfig`.
2.9.10
Vulnerable
CVE-2018-14718

Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the …
2.6.7.2
Vulnerable
2.9.7
Vulnerable
CVE-2019-16942

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2018-14721

Server-Side Request Forgery (SSRF) FasterXML jackson-databind might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure …
2.6.7.2
Vulnerable
2.9.7
Vulnerable
CVE-2020-36187

Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource`.
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
CVE-2018-19362

Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `jboss-common-core` …
2.6.7.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
CVE-2018-14719

Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the …
2.6.7.2
Vulnerable
2.9.7
Vulnerable
CVE-2018-19361

Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `openjpa` …
2.6.7.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
CVE-2019-16335

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariDataSource`. This is a …
2.9.10
Vulnerable
CVE-2018-19360

Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms …
2.6.7.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
CVE-2019-12814

Information Disclosure A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or for …
2.8.11.4
Vulnerable
2.9.9.1
Vulnerable
2.7.9.6
Vulnerable
CVE-2019-17531

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2018-14720

Improper Restriction of XML External Entity Reference FasterXML jackson-databind might allow attackers to conduct external XML entity (XXE) attacks by …
2.6.7.2
Vulnerable
2.9.7
Vulnerable
CVE-2019-16943

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2019-14893

Deserialization of Untrusted Data A flaw was discovered in FasterXML jackson-databind that permits polymorphic deserialization of malicious objects. Specifically when …
2.8.11.5
Vulnerable
2.9.10
Vulnerable
CVE-2019-17267

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`.
2.9.10
Vulnerable
GHSA-cmfg-87vq-g5g4
Aliases:
CVE-2019-12814
Deserialization of untrusted data in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When …
2.7.9.6
Vulnerable
2.7.9.6
Vulnerable
GHSA-hgj6-7826-r7m5
Aliases:
CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager …
2.18.8
Vulnerable
2.18.8
Vulnerable
CVE-2019-20330
Aliases:
GHSA-gww7-p5w4-wrfv
Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
CVE-2017-15095

Deserialization of Untrusted Data A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform …
2.7.9.2
Vulnerable
2.8.10
Vulnerable
2.9.1
Vulnerable
2.7.9.2
Vulnerable
2.8.10
Vulnerable
2.9.1
Vulnerable
CVE-2018-7489

Deserialization of Untrusted Data FasterXML jackson-databind allows unauthenticated remote code execution. This is exploitable by sending maliciously crafted JSON input …
2.7.9.3
Vulnerable
2.8.11.1
Vulnerable
2.9.5
Vulnerable
2.7.9.3
Vulnerable
2.8.11.1
Vulnerable
2.9.5
Vulnerable
CVE-2020-36183
Aliases:
GHSA-9m6f-7xcq-8vf8
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
CVE-2020-10969
Aliases:
GHSA-758m-v56v-grj4
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.7.9.7
Vulnerable
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.7.9.7
Vulnerable
CVE-2020-36518
Aliases:
GHSA-57j2-w4cx-62h2
Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
CVE-2018-1000873

Improper Input Validation Fasterxml Jackson does not properly validate user input leading to a DoS. Specifically, deserializing malicious input of …
2.9.8
Vulnerable
2.9.8
Vulnerable
GHSA-cggj-fvv3-cqwv
Aliases:
CVE-2018-7489
FasterXML jackson-databind allows unauthenticated remote code execution FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x …
2.8.11.1
Vulnerable
2.7.9.3
Vulnerable
2.8.11.1
Vulnerable
2.7.9.3
Vulnerable
2.7.9.3
Vulnerable
GHSA-r3gr-cxrf-hg25
Aliases:
CVE-2020-35491
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-qjw2-hr98-qgfh
Aliases:
CVE-2020-24750
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets …
2.9.10.6
Vulnerable
2.9.10.6
Vulnerable
GHSA-5r5r-6hpj-8gg9
Aliases:
CVE-2020-35728
Serialization gadget exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-wh8g-3j2c-rqj5
Aliases:
CVE-2020-35490
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-h3cw-g4mq-c5x2
Aliases:
CVE-2020-24616
Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x …
2.9.10.6
Vulnerable
2.9.10.6
Vulnerable
GHSA-288c-cq4h-88gq
Aliases:
CVE-2020-25649
XML External Entity (XXE) Injection in Jackson Databind A flaw was found in FasterXML Jackson Databind, where it did not …
2.9.10.7
Vulnerable
2.10.5.1
Vulnerable
2.9.10.7
Vulnerable
GHSA-57j2-w4cx-62h2
Aliases:
CVE-2020-36518
Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.12.6.1
Vulnerable
GHSA-qr7j-h6gg-jmgc
Aliases:
CVE-2018-11307
Deserialization of Untrusted Data in jackson-databind An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default …
2.7.9.4
Vulnerable
2.8.11.2
Vulnerable
2.7.9.4
Vulnerable
GHSA-cjjf-94ff-43w7
Aliases:
CVE-2018-12022
jackson-databind Deserialization of Untrusted Data vulnerability An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When …
2.7.9.4
Vulnerable
2.8.11.2
Vulnerable
2.7.9.4
Vulnerable
2.8.11.2
Vulnerable
2.7.9.4
Vulnerable
GHSA-645p-88qh-w398
Aliases:
CVE-2018-14718
Arbitrary Code Execution in jackson-databind FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute …
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.7.9.5
Vulnerable
GHSA-4gq5-ch57-c2mg
Aliases:
CVE-2018-14719
Arbitrary Code Execution in jackson-databind FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary …
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.7.9.5
Vulnerable
GHSA-9mxf-g3x6-wv74
Aliases:
CVE-2018-14721
Server-Side Request Forgery (SSRF) in jackson-databind FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery …
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.7.9.5
Vulnerable
GHSA-c8hm-7hpq-7jhg
Aliases:
CVE-2018-19362
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by …
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.7.9.5
Vulnerable
GHSA-x2w5-5m2g-7h5m
Aliases:
CVE-2018-14720
XML External Entity Reference (XXE) in jackson-databind FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity …
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.7.9.5
Vulnerable
GHSA-mx9v-gmh4-mgqw
Aliases:
CVE-2018-19361
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging …
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
GHSA-f9hv-mg5h-xcw9
Aliases:
CVE-2018-19360
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have …
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.7.9.5
Vulnerable
2.7.9.5
Vulnerable
GHSA-wv8q-qhhj-9h54
Aliases:
CVE-2026-91776
jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw …
2.18.11
Not vulnerable
GHSA-vvgp-rfg2-7rr6
Aliases:
CVE-2026-77310
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an …
2.18.9
Vulnerable
GHSA-cxp5-3px4-pw24
Aliases:
CVE-2026-91777
jackson-databind quadratic forward-reference completion ### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later …
2.18.11
Not vulnerable
GHSA-6wqp-v4v6-c87c
Aliases:
CVE-2018-12023
Deserialization of Untrusted Data An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing …
2.7.9.4
Vulnerable
2.8.11.2
Vulnerable
2.7.9.4
Vulnerable
2.8.11.2
Vulnerable
2.7.9.4
Vulnerable
GHSA-wrr7-33fx-rcvj

Deserialization of Untrusted Data in jackson-databind **Withdrawn:** Duplicate of GHSA-cjjf-94ff-43w7
2.7.9.4
Vulnerable
2.8.11.2
Vulnerable
2.7.9.4
Vulnerable
GHSA-w3f4-3q6j-rh82
Aliases:
CVE-2018-5968
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because …
2.8.11.1
Vulnerable
2.7.9.5
Vulnerable
2.7.9.5
Vulnerable
GHSA-cf6r-3wgc-h863
Aliases:
CVE-2019-14892
Polymorphic deserialization of malicious object in jackson-databind A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5, and 2.6.7.3, …
2.8.11.5
Vulnerable
2.8.11.5
Vulnerable
2.8.11.5
Vulnerable
GHSA-gww7-p5w4-wrfv
Aliases:
CVE-2019-20330
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5, and 2.9.x before …
2.7.9.7
Vulnerable
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
2.7.9.7
Vulnerable
GHSA-4w82-r329-3q67
Aliases:
CVE-2020-8840
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before …
2.7.9.7
Vulnerable
2.8.11.5
Vulnerable
2.9.10.3
Vulnerable
2.7.9.7
Vulnerable
GHSA-5gvw-p9qm-jgwh
Aliases:
CVE-2026-59889
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property …
2.18.9
Vulnerable
2.18.9
Vulnerable
2.18.9
Vulnerable
CVE-2026-54514
Aliases:
GHSA-hgj6-7826-r7m5
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name …
2.18.8
Vulnerable
2.21.4
Vulnerable
2.18.8
Vulnerable
2.21.4
Vulnerable
Vulnerabilities fixed by this package (2)

Advisory Summary Aliases
CVE-2017-7525
Deserialization of Untrusted Data A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform …
GHSA-qxxx-2pp7-5hmx
jackson-databind is vulnerable to a deserialization flaw A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and … CVE-2017-7525