Search for packages
| purl | pkg:maven/com.fasterxml.jackson.core/jackson-databind@3.0.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.6 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-hgj6-7826-r7m5
Aliases: CVE-2026-54514 |
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager … | There are no reported fixed by versions. |
|
GHSA-9fxm-vc8v-hj55
Aliases: CVE-2026-54516 |
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields ## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty("renamed")` on the getter … | There are no reported fixed by versions. |
|
GHSA-5hh8-q8hv-fr38
Aliases: CVE-2026-54517 |
jackson-databind has @JsonView bypass for setterless creator properties ## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to … | There are no reported fixed by versions. |
|
GHSA-rmj7-2vxq-3g9f
Aliases: CVE-2026-54513 |
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) ## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on … | There are no reported fixed by versions. |
|
GHSA-j3rv-43j4-c7qm
Aliases: CVE-2026-54512 |
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation `jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary … | There are no reported fixed by versions. |