What’s Vulnerable › Products
FasterXML jackson-databind vulnerabilities
85 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your FasterXML jackson-databind version is affected
Latest FasterXML jackson-databind vulnerabilities
- CVE-2026-110879 — jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) (CVSS 9.8)
- CVE-2026-91777 — jackson-databind: quadratic forward-reference completion in Collection and Map deserializers (CVSS 7.5)
- CVE-2026-91776 — jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID (CVSS 7.5)
- CVE-2026-68497 — jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service (CVSS 7.5)
- CVE-2026-83557 — jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types (CVSS 5.6)
- CVE-2026-19032 — jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path (CVSS 5.3)
- CVE-2026-59889 — jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization (CVSS 6.5)
- CVE-2026-59888 — jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy (CVSS 6.5)
- CVE-2026-54518 — jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind (CVSS 6.5)
- CVE-2026-54517 — jackson-databind: @JsonView bypass for setterless creator properties (CVSS 5.3)
- CVE-2026-54516 — jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields (CVSS 5.3)
- CVE-2026-54515 — jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties (CVSS 5.3)
- CVE-2026-54514 — jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) (CVSS 5.3)
- CVE-2026-54513 — jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) (CVSS 8.1)
- CVE-2026-54512 — jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation (CVSS 8.1)
- CVE-2026-50193 — jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() (CVSS 7.5)
- CVE-2023-35116 — (CVSS 4.7)
- CVE-2021-46877 — (CVSS 7.5)
- CVE-2020-10650 — jackson-databind vulnerable to unsafe deserialization (CVSS 8.1)
- CVE-2022-42004 — Uncontrolled Resource Consumption in FasterXML jackson-databind (CVSS 7.5)
- CVE-2022-42003 — Uncontrolled Resource Consumption in Jackson-databind (CVSS 7.5)
- CVE-2020-36518 — Deeply nested json in jackson-databind (CVSS 7.5)
- CVE-2021-20190 — Deserialization of untrusted data in jackson-databind (CVSS 8.1)
- CVE-2020-36183 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
- CVE-2020-36182 — Unsafe Deserialization in jackson-databind (CVSS 8.1)