Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.2
purl pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.2
Next non-vulnerable version 2.18.11
Latest non-vulnerable version 2.22.3
Risk score 4.4
Vulnerabilities affecting this package (74)
Advisory Summary Fixed in package version
CVE-2020-10672

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-8840

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
2.8.11.5
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
CVE-2020-10968

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-11620

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-11619

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-14195

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.11.0
Vulnerable
CVE-2020-10650

2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-14061

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and …
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.11.0
Vulnerable
CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.11.0
Vulnerable
CVE-2020-24750

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2020-10673

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-9546

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-9548

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-24616

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2020-14062

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.11.0
Vulnerable
CVE-2020-11113

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-10969

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
2.8.11.6
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-11111

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, …
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-11112

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
GHSA-v585-23hc-c647
Aliases:
CVE-2020-36186
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-89qr-369f-5m5x
Aliases:
CVE-2020-36182
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-vfqx-33qm-g869
Aliases:
CVE-2020-36189
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-r695-7vr9-jgc2
Aliases:
CVE-2020-36187
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
2.9.10.8
Vulnerable
GHSA-f9xh-2qgp-cq57
Aliases:
CVE-2020-36188
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-8c4j-34r4-xr8g
Aliases:
CVE-2020-36180
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-9m6f-7xcq-8vf8
Aliases:
CVE-2020-36183
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-cvm9-fjm9-3572
Aliases:
CVE-2020-36181
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-m6x4-97wx-4q27
Aliases:
CVE-2020-36184
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
2.9.10.8
Vulnerable
GHSA-9gph-22xh-8x98
Aliases:
CVE-2020-36179
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-8w26-6f25-cm9x
Aliases:
CVE-2020-36185
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-5949-rw7g-wx7w
Aliases:
CVE-2021-20190
Deserialization of untrusted data in jackson-databind A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction …
2.9.10.7
Vulnerable
GHSA-rgv9-q543-rqg4
Aliases:
CVE-2022-42004
Uncontrolled Resource Consumption in FasterXML jackson-databind In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-jjjh-jjxp-wpff
Aliases:
CVE-2022-42003
Uncontrolled Resource Consumption in Jackson-databind In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-rpr3-cw39-3pxh
Aliases:
CVE-2020-10650
GMS-2022-2955
jackson-databind vulnerable to unsafe deserialization The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling …
2.9.10.4
Vulnerable
GHSA-fqwf-pjwf-7vqv
Aliases:
CVE-2020-10673
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 and 2.6.7.4 mishandles the interaction between …
2.9.10.4
Vulnerable
GHSA-q93h-jc49-78gg
Aliases:
CVE-2020-9547
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.9.10.4
Vulnerable
GHSA-p43x-xfjf-5jhr
Aliases:
CVE-2020-9548
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.9.10.4
Vulnerable
CVE-2020-36187

Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource`.
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
CVE-2020-10673

Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `com.caucho.config.types.ResourceRef`.`
2.9.10.4
Vulnerable
2.6.7.4
Vulnerable
GHSA-5jmj-h7xm-6q6v
Aliases:
CVE-2026-54515
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties ## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a …
2.18.9
Vulnerable
2.18.9
Vulnerable
GHSA-hgj6-7826-r7m5
Aliases:
CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager …
2.18.8
Vulnerable
2.18.8
Vulnerable
CVE-2020-25649

Improper Restriction of XML External Entity Reference A flaw was found in FasterXML Jackson Databind, where it did not have …
2.9.10.7
Vulnerable
2.6.7.4
Vulnerable
2.10.5.1
Vulnerable
2.9.10.7
Vulnerable
2.6.7.4
Vulnerable
2.10.5.1
Vulnerable
CVE-2020-36183
Aliases:
GHSA-9m6f-7xcq-8vf8
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
CVE-2020-10969
Aliases:
GHSA-758m-v56v-grj4
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.7.9.7
Vulnerable
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.7.9.7
Vulnerable
CVE-2020-36518
Aliases:
GHSA-57j2-w4cx-62h2
Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
GHSA-r3gr-cxrf-hg25
Aliases:
CVE-2020-35491
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-qjw2-hr98-qgfh
Aliases:
CVE-2020-24750
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets …
2.9.10.6
Vulnerable
2.9.10.6
Vulnerable
GHSA-5r5r-6hpj-8gg9
Aliases:
CVE-2020-35728
Serialization gadget exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-wh8g-3j2c-rqj5
Aliases:
CVE-2020-35490
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-h3cw-g4mq-c5x2
Aliases:
CVE-2020-24616
Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x …
2.9.10.6
Vulnerable
2.9.10.6
Vulnerable
GHSA-288c-cq4h-88gq
Aliases:
CVE-2020-25649
XML External Entity (XXE) Injection in Jackson Databind A flaw was found in FasterXML Jackson Databind, where it did not …
2.9.10.7
Vulnerable
2.10.5.1
Vulnerable
2.9.10.7
Vulnerable
GHSA-57j2-w4cx-62h2
Aliases:
CVE-2020-36518
Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.12.6.1
Vulnerable
GHSA-wjgm-6hv5-3cvf
Aliases:
CVE-2026-19032
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution ### Summary A `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. …
2.18.10
Vulnerable
GHSA-wv8q-qhhj-9h54
Aliases:
CVE-2026-91776
jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw …
2.18.11
Not vulnerable
GHSA-vvgp-rfg2-7rr6
Aliases:
CVE-2026-77310
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an …
2.18.9
Vulnerable
GHSA-cxp5-3px4-pw24
Aliases:
CVE-2026-91777
jackson-databind quadratic forward-reference completion ### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later …
2.18.11
Not vulnerable
GHSA-95cm-88f5-f2c7
Aliases:
CVE-2020-10672
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-h4rc-386g-6m85
Aliases:
CVE-2020-11620
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-5p34-5m6p-p58g
Aliases:
CVE-2020-9546
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-758m-v56v-grj4
Aliases:
CVE-2020-10969
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-c265-37vj-cwcc
Aliases:
CVE-2020-14062
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, …
2.9.10.5
Vulnerable
2.9.10.5
Vulnerable
GHSA-mc6h-4qgp-37qh
Aliases:
CVE-2020-14195
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, …
2.9.10.5
Vulnerable
2.9.10.5
Vulnerable
GHSA-c2q3-4qrh-fm48
Aliases:
CVE-2020-14061
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, …
2.9.10.5
Vulnerable
2.9.10.5
Vulnerable
GHSA-58pp-9c76-5625
Aliases:
CVE-2020-11112
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-j823-4qch-3rgm
Aliases:
CVE-2020-14060
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, …
2.9.10.5
Vulnerable
2.9.10.5
Vulnerable
GHSA-27xj-rqx5-2255
Aliases:
CVE-2020-11619
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-rf6r-2c4q-2vwg
Aliases:
CVE-2020-10968
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-v3xw-c963-f5hc
Aliases:
CVE-2020-11111
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-9vvp-fxw6-jcxr
Aliases:
CVE-2020-11113
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-4w82-r329-3q67
Aliases:
CVE-2020-8840
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before …
2.9.10.3
Vulnerable
2.9.10.3
Vulnerable
GHSA-5gvw-p9qm-jgwh
Aliases:
CVE-2026-59889
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property …
2.18.9
Vulnerable
2.18.9
Vulnerable
2.18.9
Vulnerable
CVE-2026-54515
Aliases:
GHSA-5jmj-h7xm-6q6v
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer …
2.18.9
Vulnerable
2.21.5
Vulnerable
2.22.1
Vulnerable
2.18.9
Vulnerable
2.21.5
Vulnerable
2.22.1
Vulnerable
CVE-2026-54514
Aliases:
GHSA-hgj6-7826-r7m5
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name …
2.18.8
Vulnerable
2.21.4
Vulnerable
2.18.8
Vulnerable
2.21.4
Vulnerable
Vulnerabilities fixed by this package (16)

Advisory Summary Aliases
CVE-2018-5968
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the …
CVE-2019-14540
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of …
CVE-2018-7489
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete …
CVE-2018-11307
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class …
CVE-2017-7525
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user …
CVE-2019-20330
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2018-12022
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally …
CVE-2017-17485
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the …
CVE-2018-12023
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally …
CVE-2019-14439
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either …
CVE-2019-14379
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code …
CVE-2019-16335
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different …
CVE-2019-14893
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization …
CVE-2019-20330
Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. GHSA-gww7-p5w4-wrfv
GHSA-gww7-p5w4-wrfv
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5, and 2.9.x before … CVE-2019-20330