Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7
purl pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.7
Next non-vulnerable version 2.18.11
Latest non-vulnerable version 2.22.3
Risk score 4.4
Vulnerabilities affecting this package (117)
Advisory Summary Fixed in package version
CVE-2020-10672

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2018-19361

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class …
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
CVE-2019-12814

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or …
2.8.11.4
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2020-8840

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
2.8.11.5
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
CVE-2019-16943

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or …
2.8.11.5
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2020-10968

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-11620

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-11619

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-14540

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
2.8.11.5
Vulnerable
2.8.11.6
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2019-14892

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of …
2.8.11.5
Vulnerable
2.8.11.6
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2018-19360

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class …
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
CVE-2020-10650

2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-12384

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the …
2.8.11.4
Vulnerable
2.9.9.1
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2019-12086

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or …
2.8.11.4
Vulnerable
2.9.9
Vulnerable
CVE-2018-19362

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class …
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
2.9.9
Vulnerable
CVE-2020-24750

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2020-10673

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-16942

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or …
2.8.11.5
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
CVE-2020-9546

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-9548

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2019-20330

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-24616

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2020-11113

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-14439

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either …
2.8.11.4
Vulnerable
2.8.11.5
Vulnerable
2.8.11.6
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
CVE-2019-14379

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code …
2.8.11.4
Vulnerable
2.8.11.5
Vulnerable
2.8.11.6
Vulnerable
2.9.9.2
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-10969

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
2.8.11.6
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2019-17531

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or …
2.8.11.5
Vulnerable
2.9.10.1
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
CVE-2020-11111

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, …
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-16335

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different …
2.8.11.5
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
2.10.4
Vulnerable
2.10.5
Vulnerable
2.11.0
Vulnerable
2.11.1
Vulnerable
2.11.2
Vulnerable
2.9.10.6
Vulnerable
CVE-2019-14893

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization …
2.8.11.5
Vulnerable
2.9.10
Vulnerable
2.9.10.1
Vulnerable
2.9.10.2
Vulnerable
2.9.10.3
Vulnerable
2.10.0
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
CVE-2020-11112

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
2.9.10.4
Vulnerable
2.10.0
Vulnerable
2.10.0.pr1
Vulnerable
2.10.0.pr2
Vulnerable
2.10.0.pr3
Vulnerable
2.10.1
Vulnerable
2.10.2
Vulnerable
2.10.3
Vulnerable
2.11.0.rc1
Vulnerable
CVE-2019-17267

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
2.8.11.5
Vulnerable
2.9.10
Vulnerable
2.10.0
Vulnerable
GHSA-v585-23hc-c647
Aliases:
CVE-2020-36186
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-89qr-369f-5m5x
Aliases:
CVE-2020-36182
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-vfqx-33qm-g869
Aliases:
CVE-2020-36189
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-r695-7vr9-jgc2
Aliases:
CVE-2020-36187
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
2.9.10.8
Vulnerable
GHSA-f9xh-2qgp-cq57
Aliases:
CVE-2020-36188
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-8c4j-34r4-xr8g
Aliases:
CVE-2020-36180
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-9m6f-7xcq-8vf8
Aliases:
CVE-2020-36183
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-cvm9-fjm9-3572
Aliases:
CVE-2020-36181
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-m6x4-97wx-4q27
Aliases:
CVE-2020-36184
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
2.9.10.8
Vulnerable
GHSA-9gph-22xh-8x98
Aliases:
CVE-2020-36179
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.9.10.8
Vulnerable
GHSA-8w26-6f25-cm9x
Aliases:
CVE-2020-36185
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource`.
2.9.10.8
Vulnerable
GHSA-5949-rw7g-wx7w
Aliases:
CVE-2021-20190
Deserialization of untrusted data in jackson-databind A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction …
2.9.10.7
Vulnerable
GHSA-rgv9-q543-rqg4
Aliases:
CVE-2022-42004
Uncontrolled Resource Consumption in FasterXML jackson-databind In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-jjjh-jjxp-wpff
Aliases:
CVE-2022-42003
Uncontrolled Resource Consumption in Jackson-databind In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur …
2.12.7.1
Vulnerable
GHSA-rpr3-cw39-3pxh
Aliases:
CVE-2020-10650
GMS-2022-2955
jackson-databind vulnerable to unsafe deserialization The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling …
2.9.10.4
Vulnerable
GHSA-gjmw-vf9h-g25v
Aliases:
CVE-2019-17531
jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. …
2.9.10.1
Vulnerable
GHSA-fmmc-742q-jg75
Aliases:
CVE-2019-16943
jackson-databind polymorphic typing issue A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. …
2.9.10.1
Vulnerable
GHSA-mx7p-6679-8g3q
Aliases:
CVE-2019-16942
Polymorphic Typing in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing …
2.9.10.1
Vulnerable
GHSA-5ww9-j83m-q7qx
Aliases:
CVE-2019-12086
Information exposure in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing …
2.9.9
Vulnerable
GHSA-mph4-vhrx-mv67
Aliases:
CVE-2019-12384
Deserialization of Untrusted Data in FasterXML jackson-databind FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of …
2.9.9.1
Vulnerable
GHSA-6fpp-rgj9-8rwc
Aliases:
CVE-2019-14379
Deserialization of untrusted data in FasterXML jackson-databind SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when …
2.9.9.2
Vulnerable
GHSA-gwp4-hfv6-p7hw
Aliases:
CVE-2019-14439
Deserialization of untrusted data in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.4, …
2.9.9.2
Vulnerable
GHSA-85cw-hj65-qqv9
Aliases:
CVE-2019-16335
Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. …
2.9.10
Vulnerable
GHSA-h822-r4r5-v8jg
Aliases:
CVE-2019-14540
Polymorphic Typing issue in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. …
2.9.10
Vulnerable
GHSA-f3j5-rmmp-3fc5
Aliases:
CVE-2019-17267
Improper Input Validation in jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 and 2.8.11.5. It is …
2.9.10
Vulnerable
GHSA-fqwf-pjwf-7vqv
Aliases:
CVE-2020-10673
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 and 2.6.7.4 mishandles the interaction between …
2.9.10.4
Vulnerable
GHSA-qmqc-x3r4-6v39
Aliases:
CVE-2019-14893
Polymorphic deserialization of malicious object in jackson-databind A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and …
2.9.10
Vulnerable
GHSA-q93h-jc49-78gg
Aliases:
CVE-2020-9547
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.9.10.4
Vulnerable
GHSA-p43x-xfjf-5jhr
Aliases:
CVE-2020-9548
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction …
2.9.10.4
Vulnerable
CVE-2019-14540

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariConfig`.
2.9.10
Vulnerable
CVE-2019-16942

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2020-36187

Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource`.
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
CVE-2018-19362

Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `jboss-common-core` …
2.6.7.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
CVE-2018-19361

Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `openjpa` …
2.6.7.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
CVE-2019-16335

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `com.zaxxer.hikari.HikariDataSource`. This is a …
2.9.10
Vulnerable
CVE-2018-19360

Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms …
2.6.7.3
Vulnerable
2.7.9.5
Vulnerable
2.8.11.3
Vulnerable
2.9.8
Vulnerable
CVE-2020-10673

Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `com.caucho.config.types.ResourceRef`.`
2.9.10.4
Vulnerable
2.6.7.4
Vulnerable
CVE-2019-12814

Information Disclosure A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or for …
2.8.11.4
Vulnerable
2.9.9.1
Vulnerable
2.7.9.6
Vulnerable
CVE-2019-17531

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2019-16943

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or …
2.9.10.1
Vulnerable
CVE-2019-14893

Deserialization of Untrusted Data A flaw was discovered in FasterXML jackson-databind that permits polymorphic deserialization of malicious objects. Specifically when …
2.8.11.5
Vulnerable
2.9.10
Vulnerable
CVE-2019-17267

Improper Input Validation A Polymorphic Typing issue was discovered in FasterXML jackson-databind. It is related to `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`.
2.9.10
Vulnerable
GHSA-cmfg-87vq-g5g4
Aliases:
CVE-2019-12814
Deserialization of untrusted data in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When …
2.9.9.1
Vulnerable
2.9.9.1
Vulnerable
GHSA-5jmj-h7xm-6q6v
Aliases:
CVE-2026-54515
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties ## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a …
2.18.9
Vulnerable
2.18.9
Vulnerable
GHSA-hgj6-7826-r7m5
Aliases:
CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager …
2.18.8
Vulnerable
2.18.8
Vulnerable
CVE-2019-20330
Aliases:
GHSA-gww7-p5w4-wrfv
Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
2.8.11.5
Vulnerable
2.9.10.2
Vulnerable
CVE-2020-25649

Improper Restriction of XML External Entity Reference A flaw was found in FasterXML Jackson Databind, where it did not have …
2.9.10.7
Vulnerable
2.6.7.4
Vulnerable
2.10.5.1
Vulnerable
2.9.10.7
Vulnerable
2.6.7.4
Vulnerable
2.10.5.1
Vulnerable
CVE-2020-36183
Aliases:
GHSA-9m6f-7xcq-8vf8
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related …
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
2.6.7.5
Vulnerable
2.9.10.8
Vulnerable
CVE-2020-10969
Aliases:
GHSA-758m-v56v-grj4
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.7.9.7
Vulnerable
2.8.11.6
Vulnerable
2.9.10.4
Vulnerable
2.7.9.7
Vulnerable
CVE-2020-36518
Aliases:
GHSA-57j2-w4cx-62h2
Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
CVE-2018-1000873

Improper Input Validation Fasterxml Jackson does not properly validate user input leading to a DoS. Specifically, deserializing malicious input of …
2.9.8
Vulnerable
2.9.8
Vulnerable
GHSA-r3gr-cxrf-hg25
Aliases:
CVE-2020-35491
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-qjw2-hr98-qgfh
Aliases:
CVE-2020-24750
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets …
2.9.10.6
Vulnerable
2.9.10.6
Vulnerable
GHSA-5r5r-6hpj-8gg9
Aliases:
CVE-2020-35728
Serialization gadget exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-wh8g-3j2c-rqj5
Aliases:
CVE-2020-35490
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to …
2.9.10.8
Vulnerable
2.9.10.8
Vulnerable
GHSA-h3cw-g4mq-c5x2
Aliases:
CVE-2020-24616
Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x …
2.9.10.6
Vulnerable
2.9.10.6
Vulnerable
GHSA-288c-cq4h-88gq
Aliases:
CVE-2020-25649
XML External Entity (XXE) Injection in Jackson Databind A flaw was found in FasterXML Jackson Databind, where it did not …
2.9.10.7
Vulnerable
2.10.5.1
Vulnerable
2.9.10.7
Vulnerable
GHSA-57j2-w4cx-62h2
Aliases:
CVE-2020-36518
Deeply nested json in jackson-databind jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack …
2.13.2.1
Vulnerable
2.12.6.1
Vulnerable
2.12.6.1
Vulnerable
GHSA-c8hm-7hpq-7jhg
Aliases:
CVE-2018-19362
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by …
2.9.8
Vulnerable
2.9.8
Vulnerable
2.9.8
Vulnerable
GHSA-mx9v-gmh4-mgqw
Aliases:
CVE-2018-19361
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging …
2.9.8
Vulnerable
2.9.8
Vulnerable
2.9.8
Vulnerable
GHSA-f9hv-mg5h-xcw9
Aliases:
CVE-2018-19360
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have …
2.9.8
Vulnerable
2.9.8
Vulnerable
2.9.8
Vulnerable
GHSA-wjgm-6hv5-3cvf
Aliases:
CVE-2026-19032
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution ### Summary A `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. …
2.18.10
Vulnerable
GHSA-wv8q-qhhj-9h54
Aliases:
CVE-2026-91776
jackson-databind retains every unknown raw type ID ### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw …
2.18.11
Not vulnerable
GHSA-vvgp-rfg2-7rr6
Aliases:
CVE-2026-77310
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization ### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an …
2.18.9
Vulnerable
GHSA-cxp5-3px4-pw24
Aliases:
CVE-2026-91777
jackson-databind quadratic forward-reference completion ### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later …
2.18.11
Not vulnerable
GHSA-95cm-88f5-f2c7
Aliases:
CVE-2020-10672
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-h4rc-386g-6m85
Aliases:
CVE-2020-11620
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-5p34-5m6p-p58g
Aliases:
CVE-2020-9546
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-758m-v56v-grj4
Aliases:
CVE-2020-10969
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-c265-37vj-cwcc
Aliases:
CVE-2020-14062
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, …
2.9.10.5
Vulnerable
2.9.10.5
Vulnerable
GHSA-mc6h-4qgp-37qh
Aliases:
CVE-2020-14195
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, …
2.9.10.5
Vulnerable
2.9.10.5
Vulnerable
GHSA-c2q3-4qrh-fm48
Aliases:
CVE-2020-14061
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, …
2.9.10.5
Vulnerable
2.9.10.5
Vulnerable
GHSA-58pp-9c76-5625
Aliases:
CVE-2020-11112
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-j823-4qch-3rgm
Aliases:
CVE-2020-14060
Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, …
2.9.10.5
Vulnerable
2.9.10.5
Vulnerable
GHSA-cf6r-3wgc-h863
Aliases:
CVE-2019-14892
Polymorphic deserialization of malicious object in jackson-databind A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5, and 2.6.7.3, …
2.9.10
Vulnerable
2.9.10
Vulnerable
2.9.10
Vulnerable
GHSA-27xj-rqx5-2255
Aliases:
CVE-2020-11619
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-rf6r-2c4q-2vwg
Aliases:
CVE-2020-10968
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-v3xw-c963-f5hc
Aliases:
CVE-2020-11111
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-9vvp-fxw6-jcxr
Aliases:
CVE-2020-11113
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets …
2.9.10.4
Vulnerable
2.9.10.4
Vulnerable
GHSA-gww7-p5w4-wrfv
Aliases:
CVE-2019-20330
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5, and 2.9.x before …
2.9.10.2
Vulnerable
2.9.10.2
Vulnerable
GHSA-4w82-r329-3q67
Aliases:
CVE-2020-8840
Deserialization of Untrusted Data in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before …
2.9.10.3
Vulnerable
2.9.10.3
Vulnerable
GHSA-5gvw-p9qm-jgwh
Aliases:
CVE-2026-59889
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization ## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property …
2.18.9
Vulnerable
2.18.9
Vulnerable
2.18.9
Vulnerable
CVE-2026-54515
Aliases:
GHSA-5jmj-h7xm-6q6v
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer …
2.18.9
Vulnerable
2.21.5
Vulnerable
2.22.1
Vulnerable
2.18.9
Vulnerable
2.21.5
Vulnerable
2.22.1
Vulnerable
CVE-2026-54514
Aliases:
GHSA-hgj6-7826-r7m5
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name …
2.18.8
Vulnerable
2.21.4
Vulnerable
2.18.8
Vulnerable
2.21.4
Vulnerable
Vulnerabilities fixed by this package (17)

Advisory Summary Aliases
CVE-2018-5968
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the …
CVE-2018-14718
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext …
CVE-2018-14721
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to …
CVE-2017-15095
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user …
CVE-2018-11307
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class …
CVE-2018-14720
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block …
CVE-2018-12022
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally …
CVE-2018-12023
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally …
CVE-2018-14719
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt …
CVE-2018-14718
Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the …
CVE-2018-14721
Server-Side Request Forgery (SSRF) FasterXML jackson-databind might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure …
CVE-2018-14719
Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the …
CVE-2018-14720
Improper Restriction of XML External Entity Reference FasterXML jackson-databind might allow attackers to conduct external XML entity (XXE) attacks by …
GHSA-645p-88qh-w398
Arbitrary Code Execution in jackson-databind FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute … CVE-2018-14718
GHSA-4gq5-ch57-c2mg
Arbitrary Code Execution in jackson-databind FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary … CVE-2018-14719
GHSA-9mxf-g3x6-wv74
Server-Side Request Forgery (SSRF) in jackson-databind FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery … CVE-2018-14721
GHSA-x2w5-5m2g-7h5m
XML External Entity Reference (XXE) in jackson-databind FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity … CVE-2018-14720