VulnerableCode Package Details - pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.0.0-RC3

Vulnerabilities affecting this package (28)

Advisory	Summary	Fixed in package version
GHSA-rfx6-vp9g-rh7v Aliases: CVE-2017-17485	jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass FasterXML jackson-databind through 2.8.10 and 2.9.x through …	2.7.9.2 Vulnerable
GHSA-vfqx-33qm-g869 Aliases: CVE-2020-36189	Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …	2.6.7.5 Vulnerable
GHSA-5949-rw7g-wx7w Aliases: CVE-2021-20190	Deserialization of untrusted data in jackson-databind A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction …	2.6.7.5 Vulnerable
GHSA-rpr3-cw39-3pxh Aliases: CVE-2020-10650 GMS-2022-2955	jackson-databind vulnerable to unsafe deserialization The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling …	2.9.10.4 Vulnerable
GHSA-gjmw-vf9h-g25v Aliases: CVE-2019-17531	jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. …	2.6.7.3 Vulnerable
GHSA-fmmc-742q-jg75 Aliases: CVE-2019-16943	jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. …	2.6.7.3 Vulnerable
GHSA-6fpp-rgj9-8rwc Aliases: CVE-2019-14379	Deserialization of untrusted data in FasterXML jackson-databind SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when …	2.7.9.6 Vulnerable
GHSA-gwp4-hfv6-p7hw Aliases: CVE-2019-14439	Deserialization of untrusted data in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.4, …	2.6.7.3 Vulnerable
GHSA-85cw-hj65-qqv9 Aliases: CVE-2019-16335	Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. …	2.6.7.3 Vulnerable
GHSA-h822-r4r5-v8jg Aliases: CVE-2019-14540	Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. …	2.6.7.3 Vulnerable
GHSA-f3j5-rmmp-3fc5 Aliases: CVE-2019-17267	Improper Input Validation in jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 and 2.8.11.5. It is …	2.8.11.5 Vulnerable
CVE-2019-14540	Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariConfig`.	2.9.10 Vulnerable
CVE-2018-14718	Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the …	2.6.7.2 Vulnerable 2.9.7 Vulnerable
CVE-2019-16335	Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariDataSource`. This is a …	2.9.10 Vulnerable
CVE-2019-14893	Deserialization of Untrusted Data A flaw was discovered in FasterXML jackson-databind that permits polymorphic deserialization of malicious objects. Specifically when …	2.8.11.5 Vulnerable 2.9.10 Vulnerable
CVE-2019-17267	Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`.	2.9.10 Vulnerable
CVE-2017-7525	Deserialization of Untrusted Data A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform …	2.6.7.1 Vulnerable 2.7.9.1 Vulnerable 2.8.9 Vulnerable 2.6.7.1 Vulnerable 2.7.9.1 Vulnerable 2.8.9 Vulnerable
CVE-2017-15095	Deserialization of Untrusted Data A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform …	2.7.9.2 Vulnerable 2.8.10 Vulnerable 2.9.1 Vulnerable 2.7.9.2 Vulnerable 2.8.10 Vulnerable 2.9.1 Vulnerable
CVE-2018-7489	Deserialization of Untrusted Data FasterXML jackson-databind allows unauthenticated remote code execution. This is exploitable by sending maliciously crafted JSON input …	2.7.9.3 Vulnerable 2.8.11.1 Vulnerable 2.9.5 Vulnerable 2.7.9.3 Vulnerable 2.8.11.1 Vulnerable 2.9.5 Vulnerable
CVE-2020-36518 Aliases: GHSA-57j2-w4cx-62h2	Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of …	2.13.2.1 Vulnerable 2.12.6.1 Vulnerable 2.13.2.1 Vulnerable 2.12.6.1 Vulnerable
CVE-2018-1000873	Improper Input Validation Fasterxml Jackson does not properly validate user input leading to a DoS. Specifically, deserializing malicious input of …	2.9.8 Vulnerable 2.9.8 Vulnerable
GHSA-qxxx-2pp7-5hmx Aliases: CVE-2017-7525	jackson-databind is vulnerable to a deserialization flaw A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and …	2.6.7.1 Vulnerable 2.7.9.1 Vulnerable 2.6.7.1 Vulnerable
GHSA-cggj-fvv3-cqwv Aliases: CVE-2018-7489	FasterXML jackson-databind allows unauthenticated remote code execution FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x …	2.8.11.1 Vulnerable 2.6.7.5 Vulnerable 2.8.11.1 Vulnerable 2.6.7.5 Vulnerable 2.6.7.5 Vulnerable
GHSA-57j2-w4cx-62h2 Aliases: CVE-2020-36518	Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack …	2.13.2.1 Vulnerable 2.12.6.1 Vulnerable 2.12.6.1 Vulnerable
GHSA-cjjf-94ff-43w7 Aliases: CVE-2018-12022	jackson-databind Deserialization of Untrusted Data vulnerability An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When …	2.7.9.4 Vulnerable 2.8.11.2 Vulnerable 2.7.9.4 Vulnerable 2.8.11.2 Vulnerable 2.7.9.4 Vulnerable
GHSA-w3f4-3q6j-rh82 Aliases: CVE-2018-5968	Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because …	2.8.11.1 Vulnerable 2.7.9.5 Vulnerable 2.7.9.5 Vulnerable
GHSA-cf6r-3wgc-h863 Aliases: CVE-2019-14892	Polymorphic deserialization of malicious object in jackson-databind A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5, and 2.6.7.3, …	2.6.7.3 Vulnerable 2.8.11.5 Vulnerable 2.6.7.3 Vulnerable 2.8.11.5 Vulnerable 2.6.7.3 Vulnerable
GHSA-5gvw-p9qm-jgwh Aliases: CVE-2026-59889	jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property …	2.18.9 Vulnerable 2.18.9 Vulnerable 2.18.9 Vulnerable

Next non-vulnerable version	2.18.11
Latest non-vulnerable version	2.22.3
Risk score	4.4