Search for packages
| purl | pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.0.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rfx6-vp9g-rh7v
Aliases: CVE-2017-17485 |
jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass FasterXML jackson-databind through 2.8.10 and 2.9.x through … |
Vulnerable |
|
GHSA-h592-38cm-4ggp
Aliases: CVE-2017-15095 |
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution jackson-databind in versions prior to 2.8.11 and 2.9.4 contain … |
Vulnerable |
|
GHSA-v585-23hc-c647
Aliases: CVE-2020-36186 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource`. |
Vulnerable |
|
GHSA-89qr-369f-5m5x
Aliases: CVE-2020-36182 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-vfqx-33qm-g869
Aliases: CVE-2020-36189 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-r695-7vr9-jgc2
Aliases: CVE-2020-36187 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. |
Vulnerable |
|
GHSA-f9xh-2qgp-cq57
Aliases: CVE-2020-36188 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-8c4j-34r4-xr8g
Aliases: CVE-2020-36180 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-9m6f-7xcq-8vf8
Aliases: CVE-2020-36183 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-cvm9-fjm9-3572
Aliases: CVE-2020-36181 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-m6x4-97wx-4q27
Aliases: CVE-2020-36184 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. |
Vulnerable |
|
GHSA-9gph-22xh-8x98
Aliases: CVE-2020-36179 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable |
|
GHSA-8w26-6f25-cm9x
Aliases: CVE-2020-36185 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource`. |
Vulnerable |
|
GHSA-5949-rw7g-wx7w
Aliases: CVE-2021-20190 |
Deserialization of untrusted data in jackson-databind A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction … |
Vulnerable |
|
GHSA-rpr3-cw39-3pxh
Aliases: CVE-2020-10650 GMS-2022-2955 |
jackson-databind vulnerable to unsafe deserialization The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling … |
Vulnerable |
|
GHSA-gjmw-vf9h-g25v
Aliases: CVE-2019-17531 |
jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. … |
Vulnerable |
|
GHSA-fmmc-742q-jg75
Aliases: CVE-2019-16943 |
jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. … |
Vulnerable |
|
GHSA-mx7p-6679-8g3q
Aliases: CVE-2019-16942 |
Polymorphic Typing in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing … |
Vulnerable |
|
GHSA-5ww9-j83m-q7qx
Aliases: CVE-2019-12086 |
Information exposure in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing … |
Vulnerable |
|
GHSA-mph4-vhrx-mv67
Aliases: CVE-2019-12384 |
Deserialization of Untrusted Data in FasterXML jackson-databind FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of … |
Vulnerable |
|
GHSA-6fpp-rgj9-8rwc
Aliases: CVE-2019-14379 |
Deserialization of untrusted data in FasterXML jackson-databind SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when … |
Vulnerable |
|
GHSA-gwp4-hfv6-p7hw
Aliases: CVE-2019-14439 |
Deserialization of untrusted data in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.4, … |
Vulnerable |
|
GHSA-85cw-hj65-qqv9
Aliases: CVE-2019-16335 |
Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. … |
Vulnerable |
|
GHSA-h822-r4r5-v8jg
Aliases: CVE-2019-14540 |
Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. … |
Vulnerable |
|
GHSA-f3j5-rmmp-3fc5
Aliases: CVE-2019-17267 |
Improper Input Validation in jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 and 2.8.11.5. It is … |
Vulnerable |
|
GHSA-fqwf-pjwf-7vqv
Aliases: CVE-2020-10673 |
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 and 2.6.7.4 mishandles the interaction between … |
Vulnerable |
|
GHSA-q93h-jc49-78gg
Aliases: CVE-2020-9547 |
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction … |
Vulnerable |
|
GHSA-p43x-xfjf-5jhr
Aliases: CVE-2020-9548 |
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction … |
Vulnerable |
|
CVE-2019-14540
|
Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariConfig`. |
Vulnerable |
|
CVE-2018-14718
|
Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the … |
Vulnerable Vulnerable |
|
CVE-2019-16942
|
Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or … |
Vulnerable |
|
CVE-2020-36187
|
Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource`. |
Vulnerable Vulnerable |
|
CVE-2019-16335
|
Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariDataSource`. This is a … |
Vulnerable |
|
CVE-2019-17531
|
Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or … |
Vulnerable |
|
CVE-2019-16943
|
Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or … |
Vulnerable |
|
CVE-2019-14893
|
Deserialization of Untrusted Data A flaw was discovered in FasterXML jackson-databind that permits polymorphic deserialization of malicious objects. Specifically when … |
Vulnerable Vulnerable |
|
CVE-2019-17267
|
Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`. |
Vulnerable |
|
GHSA-cmfg-87vq-g5g4
Aliases: CVE-2019-12814 |
Deserialization of untrusted data in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When … |
Vulnerable Vulnerable |
|
GHSA-hgj6-7826-r7m5
Aliases: CVE-2026-54514 |
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager … |
Vulnerable Vulnerable |
|
CVE-2017-7525
|
Deserialization of Untrusted Data A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-20330
Aliases: GHSA-gww7-p5w4-wrfv |
Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-15095
|
Deserialization of Untrusted Data A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-7489
|
Deserialization of Untrusted Data FasterXML jackson-databind allows unauthenticated remote code execution. This is exploitable by sending maliciously crafted JSON input … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-36183
Aliases: GHSA-9m6f-7xcq-8vf8 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-36518
Aliases: GHSA-57j2-w4cx-62h2 |
Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1000873
|
Improper Input Validation Fasterxml Jackson does not properly validate user input leading to a DoS. Specifically, deserializing malicious input of … |
Vulnerable Vulnerable |
|
GHSA-qxxx-2pp7-5hmx
Aliases: CVE-2017-7525 |
jackson-databind is vulnerable to a deserialization flaw A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-cggj-fvv3-cqwv
Aliases: CVE-2018-7489 |
FasterXML jackson-databind allows unauthenticated remote code execution FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-r3gr-cxrf-hg25
Aliases: CVE-2020-35491 |
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to … |
Vulnerable Vulnerable |
|
GHSA-qjw2-hr98-qgfh
Aliases: CVE-2020-24750 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-5r5r-6hpj-8gg9
Aliases: CVE-2020-35728 |
Serialization gadget exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to … |
Vulnerable Vulnerable |
|
GHSA-wh8g-3j2c-rqj5
Aliases: CVE-2020-35490 |
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to … |
Vulnerable Vulnerable |
|
GHSA-h3cw-g4mq-c5x2
Aliases: CVE-2020-24616 |
Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x … |
Vulnerable Vulnerable |
|
GHSA-57j2-w4cx-62h2
Aliases: CVE-2020-36518 |
Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-qr7j-h6gg-jmgc
Aliases: CVE-2018-11307 |
Deserialization of Untrusted Data in jackson-databind An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-cjjf-94ff-43w7
Aliases: CVE-2018-12022 |
jackson-databind Deserialization of Untrusted Data vulnerability An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-645p-88qh-w398
Aliases: CVE-2018-14718 |
Arbitrary Code Execution in jackson-databind FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-4gq5-ch57-c2mg
Aliases: CVE-2018-14719 |
Arbitrary Code Execution in jackson-databind FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-c8hm-7hpq-7jhg
Aliases: CVE-2018-19362 |
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-wv8q-qhhj-9h54
Aliases: CVE-2026-91776 |
jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw … |
Not vulnerable |
|
GHSA-vvgp-rfg2-7rr6
Aliases: CVE-2026-77310 |
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an … |
Vulnerable |
|
GHSA-w3f4-3q6j-rh82
Aliases: CVE-2018-5968 |
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-cf6r-3wgc-h863
Aliases: CVE-2019-14892 |
Polymorphic deserialization of malicious object in jackson-databind A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5, and 2.6.7.3, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-gww7-p5w4-wrfv
Aliases: CVE-2019-20330 |
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5, and 2.9.x before … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-4w82-r329-3q67
Aliases: CVE-2020-8840 |
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-5gvw-p9qm-jgwh
Aliases: CVE-2026-59889 |
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-54514
Aliases: GHSA-hgj6-7826-r7m5 |
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name … |
Vulnerable Vulnerable Vulnerable Vulnerable |