Search for packages
| purl | pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rgv9-q543-rqg4
Aliases: CVE-2022-42004 |
Uncontrolled Resource Consumption in FasterXML jackson-databind In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur … |
Vulnerable |
|
GHSA-jjjh-jjxp-wpff
Aliases: CVE-2022-42003 |
Uncontrolled Resource Consumption in Jackson-databind In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur … |
Vulnerable |
|
GHSA-3x8x-79m2-3w2w
Aliases: CVE-2021-46877 |
jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x … |
Vulnerable |
|
GHSA-5jmj-h7xm-6q6v
Aliases: CVE-2026-54515 |
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties ## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a … |
Vulnerable Vulnerable |
|
GHSA-hgj6-7826-r7m5
Aliases: CVE-2026-54514 |
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager … |
Vulnerable Vulnerable |
|
CVE-2020-36518
Aliases: GHSA-57j2-w4cx-62h2 |
Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-50193
Aliases: GHSA-3wrr-7qpf-2prh |
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) … |
Vulnerable |
|
GHSA-rmj7-2vxq-3g9f
Aliases: CVE-2026-54513 |
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) ## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-57j2-w4cx-62h2
Aliases: CVE-2020-36518 |
Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-3wrr-7qpf-2prh
Aliases: CVE-2026-50193 |
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() ### Impact Potential Denial-of-Service when attacker sends deeply nested JSON if (and … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-j3rv-43j4-c7qm
Aliases: CVE-2026-54512 |
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation `jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-wjgm-6hv5-3cvf
Aliases: CVE-2026-19032 |
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution ### Summary A `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. … |
Vulnerable |
|
GHSA-wv8q-qhhj-9h54
Aliases: CVE-2026-91776 |
jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw … |
Not vulnerable |
|
GHSA-vvgp-rfg2-7rr6
Aliases: CVE-2026-77310 |
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an … |
Vulnerable |
|
GHSA-cxp5-3px4-pw24
Aliases: CVE-2026-91777 |
jackson-databind quadratic forward-reference completion ### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later … |
Not vulnerable |
|
GHSA-gx83-3vf8-gh7j
Aliases: CVE-2026-83557 |
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) ### Summary `DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever … |
Vulnerable |
|
GHSA-5gvw-p9qm-jgwh
Aliases: CVE-2026-59889 |
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-54515
Aliases: GHSA-5jmj-h7xm-6q6v |
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-54514
Aliases: GHSA-hgj6-7826-r7m5 |
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-54512
Aliases: GHSA-j3rv-43j4-c7qm |
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation `jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-54513
Aliases: GHSA-rmj7-2vxq-3g9f |
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2018-5968
|
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the … | |
|
CVE-2019-14540
|
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. | |
|
CVE-2020-24750
|
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. | |
|
CVE-2018-11307
|
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class … | |
|
CVE-2018-12022
|
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally … | |
|
CVE-2020-24616
|
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). | |
|
CVE-2018-12023
|
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally … | |
|
CVE-2019-16335
|
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different … |