Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.5
purl pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.5
Next non-vulnerable version 2.18.11
Latest non-vulnerable version 2.22.3
Risk score 4.4
Vulnerabilities affecting this package (87)
Advisory Summary Fixed in package version
CVE-2020-10672

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-12814

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or …
2.8.11.4
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2019-16943

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or …
2.8.11.5
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2020-10968

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-10650

2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-12384

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the …
2.8.11.4
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2019-12086

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or …
2.8.11.4
Vulnerable
2.9.9
Vulnerable
CVE-2020-24750

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2020-10673

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-16942

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or …
2.8.11.5
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2020-9546

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-9548

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2019-20330

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-24616

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2020-11113

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-14439

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either …
2.8.11.4
Vulnerable
2.8.11.5
Vulnerable
2.8.11.6
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
CVE-2019-14379

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code …
2.8.11.4
Vulnerable
2.8.11.5
Vulnerable
2.8.11.6
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-10969

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
2.8.11.6
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2019-17531

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or …
2.8.11.5
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
CVE-2020-11111

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, …
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-16335

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different …
2.8.11.5
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2020-11112

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-17267

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
2.8.11.5
Vulnerable
2.9.10
Vulnerable
2.10.0
Vulnerable
GHSA-v585-23hc-c647
Aliases:
CVE-2020-36186
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-89qr-369f-5m5x
Aliases:
CVE-2020-36182
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-vfqx-33qm-g869
Aliases:
CVE-2020-36189
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-r695-7vr9-jgc2
Aliases:
CVE-2020-36187
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
2.9.10.8
Vulnerable
GHSA-f9xh-2qgp-cq57
Aliases:
CVE-2020-36188
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-8c4j-34r4-xr8g
Aliases:
CVE-2020-36180
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-9m6f-7xcq-8vf8
Aliases:
CVE-2020-36183
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-cvm9-fjm9-3572
Aliases:
CVE-2020-36181
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-m6x4-97wx-4q27
Aliases:
CVE-2020-36184
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
2.9.10.8
Vulnerable
GHSA-9gph-22xh-8x98
Aliases:
CVE-2020-36179
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-8w26-6f25-cm9x
Aliases:
CVE-2020-36185
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-5949-rw7g-wx7w
Aliases:
CVE-2021-20190
Deserialization of untrusted data in jackson-databind A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction …
2.9.10.7
Vulnerable
GHSA-rgv9-q543-rqg4
Aliases:
CVE-2022-42004
Uncontrolled Resource Consumption in FasterXML jackson-databind In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-jjjh-jjxp-wpff
Aliases:
CVE-2022-42003
Uncontrolled Resource Consumption in Jackson-databind In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-rpr3-cw39-3pxh
Aliases:
CVE-2020-10650
GMS-2022-2955
jackson-databind vulnerable to unsafe deserialization The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling …
2.9.10.4
Vulnerable
GHSA-gjmw-vf9h-g25v
Aliases:
CVE-2019-17531
jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. …
2.8.11.5
Vulnerable
GHSA-fmmc-742q-jg75
Aliases:
CVE-2019-16943
jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. …
2.8.11.5
Vulnerable
GHSA-mx7p-6679-8g3q
Aliases:
CVE-2019-16942
Polymorphic Typing in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing …
2.8.11.5
Vulnerable
GHSA-5ww9-j83m-q7qx
Aliases:
CVE-2019-12086
Information exposure in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing …
2.7.9.6
Vulnerable
GHSA-mph4-vhrx-mv67
Aliases:
CVE-2019-12384
Deserialization of Untrusted Data in FasterXML jackson-databind FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of …
2.7.9.6
Vulnerable
GHSA-6fpp-rgj9-8rwc
Aliases:
CVE-2019-14379
Deserialization of untrusted data in FasterXML jackson-databind SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when …
2.7.9.6
Vulnerable
GHSA-gwp4-hfv6-p7hw
Aliases:
CVE-2019-14439
Deserialization of untrusted data in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.4, …
2.7.9.6
Vulnerable
GHSA-85cw-hj65-qqv9
Aliases:
CVE-2019-16335
Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. …
2.8.11.5
Vulnerable
GHSA-h822-r4r5-v8jg
Aliases:
CVE-2019-14540
Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. …
2.8.11.5
Vulnerable
GHSA-f3j5-rmmp-3fc5
Aliases:
CVE-2019-17267
Improper Input Validation in jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 and 2.8.11.5. It is …
2.8.11.5
Vulnerable
GHSA-fqwf-pjwf-7vqv
Aliases:
CVE-2020-10673
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 and 2.6.7.4 mishandles the interaction between …
2.9.10.4
Vulnerable
GHSA-q93h-jc49-78gg
Aliases:
CVE-2020-9547
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.7.9.7
Vulnerable
GHSA-p43x-xfjf-5jhr
Aliases:
CVE-2020-9548
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.7.9.7
Vulnerable
CVE-2019-14540

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariConfig`.
2.9.10
Vulnerable
CVE-2018-14718

Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the …
2.6.7.2
Vulnerable
2.9.7
Vulnerable
CVE-2019-16942

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2018-14721

Server-Side Request Forgery (SSRF) FasterXML jackson-databind might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure …
2.6.7.2
Vulnerable
2.9.7
Vulnerable
CVE-2020-36187

Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource`.
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
CVE-2018-14719

Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the …
2.6.7.2
Vulnerable
2.9.7
Vulnerable
CVE-2019-16335

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariDataSource`. This is a …
2.9.10
Vulnerable
CVE-2019-12814

Information Disclosure A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or for …
2.8.11.4
Vulnerable
2.9.9.1
Vulnerable
2.7.9.6
Vulnerable
CVE-2019-17531

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2018-14720

Improper Restriction of XML External Entity Reference FasterXML jackson-databind might allow attackers to conduct external XML entity (XXE) attacks by …
2.6.7.2
Vulnerable
2.9.7
Vulnerable
CVE-2019-16943

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2019-14893

Deserialization of Untrusted Data A flaw was discovered in FasterXML jackson-databind that permits polymorphic deserialization of malicious objects. Specifically when …
2.8.11.5
Vulnerable
2.9.10
Vulnerable
CVE-2019-17267

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`.
2.9.10
Vulnerable
GHSA-cmfg-87vq-g5g4
Aliases:
CVE-2019-12814
Deserialization of untrusted data in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When …
2.7.9.6
Vulnerable
2.7.9.6
Vulnerable
GHSA-hgj6-7826-r7m5
Aliases:
CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager …
2.18.8
Vulnerable
2.18.8
Vulnerable
CVE-2019-20330
Aliases:
GHSA-gww7-p5w4-wrfv
Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
CVE-2020-36183
Aliases:
GHSA-9m6f-7xcq-8vf8
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
CVE-2020-10969
Aliases:
GHSA-758m-v56v-grj4
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.7.9.7
Vulnerable
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.7.9.7
Vulnerable
CVE-2020-36518
Aliases:
GHSA-57j2-w4cx-62h2
Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
CVE-2018-1000873

Improper Input Validation Fasterxml Jackson does not properly validate user input leading to a DoS. Specifically, deserializing malicious input of …
2.9.8
Vulnerable
2.9.8
Vulnerable
GHSA-r3gr-cxrf-hg25
Aliases:
CVE-2020-35491
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-qjw2-hr98-qgfh
Aliases:
CVE-2020-24750
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets …
2.9.10.6
Vulnerable
2.9.10.6
Vulnerable
GHSA-5r5r-6hpj-8gg9
Aliases:
CVE-2020-35728
Serialization gadget exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-wh8g-3j2c-rqj5
Aliases:
CVE-2020-35490
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-h3cw-g4mq-c5x2
Aliases:
CVE-2020-24616
Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x …
2.9.10.6
Vulnerable
2.9.10.6
Vulnerable
GHSA-288c-cq4h-88gq
Aliases:
CVE-2020-25649
XML External Entity (XXE) Injection in Jackson Databind A flaw was found in FasterXML Jackson Databind, where it did not …
2.9.10.7
Vulnerable
2.10.5.1
Vulnerable
2.9.10.7
Vulnerable
GHSA-57j2-w4cx-62h2
Aliases:
CVE-2020-36518
Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.12.6.1
Vulnerable
GHSA-wv8q-qhhj-9h54
Aliases:
CVE-2026-91776
jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw …
2.18.11
Not vulnerable
GHSA-vvgp-rfg2-7rr6
Aliases:
CVE-2026-77310
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an …
2.18.9
Vulnerable
GHSA-cxp5-3px4-pw24
Aliases:
CVE-2026-91777
jackson-databind quadratic forward-reference completion ### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later …
2.18.11
Not vulnerable
GHSA-cf6r-3wgc-h863
Aliases:
CVE-2019-14892
Polymorphic deserialization of malicious object in jackson-databind A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5, and 2.6.7.3, …
2.8.11.5
Vulnerable
2.8.11.5
Vulnerable
2.8.11.5
Vulnerable
GHSA-gww7-p5w4-wrfv
Aliases:
CVE-2019-20330
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5, and 2.9.x before …
2.7.9.7
Vulnerable
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
2.7.9.7
Vulnerable
GHSA-4w82-r329-3q67
Aliases:
CVE-2020-8840
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before …
2.7.9.7
Vulnerable
2.8.11.5
Vulnerable
2.9.10.3
Vulnerable
2.7.9.7
Vulnerable
GHSA-5gvw-p9qm-jgwh
Aliases:
CVE-2026-59889
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property …
2.18.9
Vulnerable
2.18.9
Vulnerable
2.18.9
Vulnerable
CVE-2026-54514
Aliases:
GHSA-hgj6-7826-r7m5
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name …
2.18.8
Vulnerable
2.21.4
Vulnerable
2.18.8
Vulnerable
2.21.4
Vulnerable
Vulnerabilities fixed by this package (24)

Advisory Summary Aliases
CVE-2018-5968
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the …
CVE-2018-19361
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class …
CVE-2018-14718
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext …
CVE-2018-14721
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to …
CVE-2018-7489
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete …
CVE-2018-19360
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class …
CVE-2018-19362
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class …
CVE-2018-11307
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class …
CVE-2018-14720
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block …
CVE-2018-12022
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally …
CVE-2017-17485
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the …
CVE-2018-12023
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally …
CVE-2018-14719
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt …
CVE-2018-19362
Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `jboss-common-core` …
CVE-2018-19361
Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `openjpa` …
CVE-2018-19360
Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms …
GHSA-645p-88qh-w398
Arbitrary Code Execution in jackson-databind FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute … CVE-2018-14718
GHSA-4gq5-ch57-c2mg
Arbitrary Code Execution in jackson-databind FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary … CVE-2018-14719
GHSA-9mxf-g3x6-wv74
Server-Side Request Forgery (SSRF) in jackson-databind FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery … CVE-2018-14721
GHSA-c8hm-7hpq-7jhg
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by … CVE-2018-19362
GHSA-x2w5-5m2g-7h5m
XML External Entity Reference (XXE) in jackson-databind FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity … CVE-2018-14720
GHSA-mx9v-gmh4-mgqw
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging … CVE-2018-19361
GHSA-f9hv-mg5h-xcw9
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have … CVE-2018-19360
GHSA-w3f4-3q6j-rh82
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because … CVE-2018-5968