Search for packages
| purl | pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2020-14195
|
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity). |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-14061
|
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-14060
|
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill). |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-24750
|
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-24616
|
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-14062
|
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2). |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-v585-23hc-c647
Aliases: CVE-2020-36186 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource`. |
Vulnerable |
|
GHSA-89qr-369f-5m5x
Aliases: CVE-2020-36182 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-vfqx-33qm-g869
Aliases: CVE-2020-36189 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-r695-7vr9-jgc2
Aliases: CVE-2020-36187 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. |
Vulnerable |
|
GHSA-f9xh-2qgp-cq57
Aliases: CVE-2020-36188 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-8c4j-34r4-xr8g
Aliases: CVE-2020-36180 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-9m6f-7xcq-8vf8
Aliases: CVE-2020-36183 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-cvm9-fjm9-3572
Aliases: CVE-2020-36181 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-m6x4-97wx-4q27
Aliases: CVE-2020-36184 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. |
Vulnerable |
|
GHSA-9gph-22xh-8x98
Aliases: CVE-2020-36179 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-8w26-6f25-cm9x
Aliases: CVE-2020-36185 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource`. |
Vulnerable |
|
GHSA-5949-rw7g-wx7w
Aliases: CVE-2021-20190 |
Deserialization of untrusted data in jackson-databind A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction … |
Vulnerable |
|
GHSA-rgv9-q543-rqg4
Aliases: CVE-2022-42004 |
Uncontrolled Resource Consumption in FasterXML jackson-databind In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur … |
Vulnerable |
|
GHSA-jjjh-jjxp-wpff
Aliases: CVE-2022-42003 |
Uncontrolled Resource Consumption in Jackson-databind In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur … |
Vulnerable |
|
CVE-2020-36187
|
Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource`. |
Vulnerable Vulnerable |
|
GHSA-5jmj-h7xm-6q6v
Aliases: CVE-2026-54515 |
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties ## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a … |
Vulnerable Vulnerable |
|
GHSA-hgj6-7826-r7m5
Aliases: CVE-2026-54514 |
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager … |
Vulnerable Vulnerable |
|
CVE-2020-25649
|
Improper Restriction of XML External Entity Reference A flaw was found in FasterXML Jackson Databind, where it did not have … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-36183
Aliases: GHSA-9m6f-7xcq-8vf8 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-36518
Aliases: GHSA-57j2-w4cx-62h2 |
Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-r3gr-cxrf-hg25
Aliases: CVE-2020-35491 |
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to … |
Vulnerable Vulnerable |
|
GHSA-qjw2-hr98-qgfh
Aliases: CVE-2020-24750 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets … |
Vulnerable Vulnerable |
|
GHSA-5r5r-6hpj-8gg9
Aliases: CVE-2020-35728 |
Serialization gadget exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to … |
Vulnerable Vulnerable |
|
GHSA-wh8g-3j2c-rqj5
Aliases: CVE-2020-35490 |
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to … |
Vulnerable Vulnerable |
|
GHSA-h3cw-g4mq-c5x2
Aliases: CVE-2020-24616 |
Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x … |
Vulnerable Vulnerable |
|
GHSA-288c-cq4h-88gq
Aliases: CVE-2020-25649 |
XML External Entity (XXE) Injection in Jackson Databind A flaw was found in FasterXML Jackson Databind, where it did not … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-57j2-w4cx-62h2
Aliases: CVE-2020-36518 |
Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-wjgm-6hv5-3cvf
Aliases: CVE-2026-19032 |
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution ### Summary A `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. … |
Vulnerable |
|
GHSA-wv8q-qhhj-9h54
Aliases: CVE-2026-91776 |
jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw … |
Not vulnerable |
|
GHSA-vvgp-rfg2-7rr6
Aliases: CVE-2026-77310 |
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an … |
Vulnerable |
|
GHSA-cxp5-3px4-pw24
Aliases: CVE-2026-91777 |
jackson-databind quadratic forward-reference completion ### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later … |
Not vulnerable |
|
GHSA-c265-37vj-cwcc
Aliases: CVE-2020-14062 |
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, … |
Vulnerable Vulnerable |
|
GHSA-mc6h-4qgp-37qh
Aliases: CVE-2020-14195 |
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, … |
Vulnerable Vulnerable |
|
GHSA-c2q3-4qrh-fm48
Aliases: CVE-2020-14061 |
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, … |
Vulnerable Vulnerable |
|
GHSA-j823-4qch-3rgm
Aliases: CVE-2020-14060 |
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, … |
Vulnerable Vulnerable |
|
GHSA-5gvw-p9qm-jgwh
Aliases: CVE-2026-59889 |
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-54515
Aliases: GHSA-5jmj-h7xm-6q6v |
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-54514
Aliases: GHSA-hgj6-7826-r7m5 |
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name … |
Vulnerable Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2020-10672
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms). | |
|
CVE-2018-5968
|
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the … | |
|
CVE-2020-10968
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy). | |
|
CVE-2020-11620
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly). | |
|
CVE-2020-11619
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop). | |
|
CVE-2019-14540
|
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. | |
|
CVE-2020-10650
|
||
|
CVE-2020-10673
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus). | |
|
CVE-2018-11307
|
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class … | |
|
CVE-2020-9546
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config). | |
|
CVE-2020-9548
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). | |
|
CVE-2018-12022
|
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally … | |
|
CVE-2017-17485
|
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the … | |
|
CVE-2018-12023
|
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally … | |
|
CVE-2020-11113
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). | |
|
CVE-2020-9547
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). | |
|
CVE-2020-11111
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, … | |
|
CVE-2019-16335
|
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different … | |
|
CVE-2020-11112
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy). | |
|
GHSA-rpr3-cw39-3pxh
|
jackson-databind vulnerable to unsafe deserialization The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling … |
CVE-2020-10650
GMS-2022-2955 |
|
GHSA-fqwf-pjwf-7vqv
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 and 2.6.7.4 mishandles the interaction between … |
CVE-2020-10673
|
|
GHSA-q93h-jc49-78gg
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction … |
CVE-2020-9547
|
|
GHSA-p43x-xfjf-5jhr
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction … |
CVE-2020-9548
|
|
CVE-2020-10673
|
Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `com.caucho.config.types.ResourceRef`.` | |
|
CVE-2020-9547
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction … |
GHSA-q93h-jc49-78gg
|
|
CVE-2020-9548
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction … |
GHSA-p43x-xfjf-5jhr
|
|
CVE-2020-10969
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
GHSA-758m-v56v-grj4
|
|
GHSA-95cm-88f5-f2c7
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
CVE-2020-10672
|
|
GHSA-h4rc-386g-6m85
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
CVE-2020-11620
|
|
GHSA-5p34-5m6p-p58g
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
CVE-2020-9546
|
|
GHSA-758m-v56v-grj4
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
CVE-2020-10969
|
|
GHSA-58pp-9c76-5625
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
CVE-2020-11112
|
|
GHSA-27xj-rqx5-2255
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
CVE-2020-11619
|
|
GHSA-rf6r-2c4q-2vwg
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
CVE-2020-10968
|
|
GHSA-v3xw-c963-f5hc
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
CVE-2020-11111
|
|
GHSA-9vvp-fxw6-jcxr
|
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets … |
CVE-2020-11113
|