Search for packages
| purl | pkg:maven/com.fasterxml.jackson.core/jackson-databind@3.1.4 |
| Tags | Ghost |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-5jmj-h7xm-6q6v
|
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties ## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a … |
CVE-2026-54515
|
|
GHSA-hgj6-7826-r7m5
|
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) ## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager … |
CVE-2026-54514
|
|
GHSA-9fxm-vc8v-hj55
|
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields ## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty("renamed")` on the getter … |
CVE-2026-54516
|
|
GHSA-5hh8-q8hv-fr38
|
jackson-databind has @JsonView bypass for setterless creator properties ## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to … |
CVE-2026-54517
|
|
GHSA-rmj7-2vxq-3g9f
|
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) ## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on … |
CVE-2026-54513
|
|
GHSA-j3rv-43j4-c7qm
|
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation `jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary … |
CVE-2026-54512
|