Search for packages
| purl | pkg:maven/tools.jackson.core/jackson-databind@3.1.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-wjgm-6hv5-3cvf
Aliases: CVE-2026-19032 |
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution ### Summary A `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. … |
Vulnerable |
|
GHSA-wv8q-qhhj-9h54
Aliases: CVE-2026-91776 |
jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw … |
Not vulnerable |
|
GHSA-q4xh-88c3-wmh7
Aliases: CVE-2026-68497 |
jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS ### Summary `jackson-databind` 3.2.1 deserializes a JSON **string** bound to a `javax.xml.datatype.Duration` or … |
Vulnerable |
|
GHSA-cxp5-3px4-pw24
Aliases: CVE-2026-91777 |
jackson-databind quadratic forward-reference completion ### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later … |
Not vulnerable |
|
GHSA-gx83-3vf8-gh7j
Aliases: CVE-2026-83557 |
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) ### Summary `DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-vvgp-rfg2-7rr6
|
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an … |
CVE-2026-77310
|
|
GHSA-5gvw-p9qm-jgwh
|
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property … |
CVE-2026-59889
|