jackson-databind vulnerabilities | LiveThreat CVE Feed

Product

jackson-databind

by FasterXML · last CVE Oct 28, 2026

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities86 In the news0 Timeline

Severity mix

Critical 27High 47Medium 12Low 0

Severity

All severities86 Critical27 High47 Medium12 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add jackson-databind to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2018-14721	10.0	10%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class… Affected: 2.6.0 before 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.7; 2.7.0; 2.7.0; +7 more
CVE-2026-110879 New	9.8	–	Oct 28	jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) Affected: 2.10.0 before 2.18.12; 2.19.0 before 2.21.8; 2.22.0 before 2.22.4; 3.0.0 before 3.1.8; 3.2.0 before 3.2.4
CVE-2019-14893	9.8	4%	Mar 2	A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the… Affected: 2.8.0 before 2.8.11.5; 2.9.0 before 2.9.10
CVE-2019-14892	9.8	6%	Mar 2	A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using… Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10
CVE-2020-9546	9.8	5%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.6; 2.9.0 before 2.9.10.4
CVE-2020-9547	9.8	18%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.6; 2.9.0 before 2.9.10.4
CVE-2020-9548	9.8	19%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.6; 2.9.0 before 2.9.10.4
CVE-2020-8840	9.8	27%	Feb 10	FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.5; 2.9.0 before 2.9.10.3
CVE-2019-20330	9.8	9%	Jan 3	FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.5; 2.9.0 before 2.9.10.2
CVE-2019-17531	9.8	5%	Oct 12	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10.1
CVE-2019-17267	9.8	5%	Oct 6	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 2.0.0 before 2.8.11.5; 2.9.0 before 2.9.10
CVE-2019-16943	9.8	5%	Oct 1	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10.1
CVE-2019-16942	9.8	6%	Oct 1	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.8.0 before 2.8.11.5; 2.9.0 before 2.9.10.1
CVE-2019-16335	9.8	5%	Sep 15	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10
CVE-2019-14540	9.8	11%	Sep 15	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10
CVE-2019-14379	9.8	8%	Jul 29	SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.6; 2.8.0 before 2.8.11.4; 2.9.0 before 2.9.9.2
CVE-2018-11307	9.8	6%	Jul 9	An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.4; 2.8.0 before 2.8.11.2; 2.9.0 before 2.9.6
CVE-2018-19360	9.8	11%	Jan 2	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic… Affected: 2.6.0 through 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.8
CVE-2018-19361	9.8	11%	Jan 2	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization Affected: 2.6.0 through 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.8
CVE-2018-14718	9.8	13%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic… Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.7
CVE-2018-14720	9.8	8%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from… Affected: 2.6.0 before 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.7; 2.7.0; 2.7.0; +7 more
CVE-2018-19362	9.8	11%	Jan 2	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic… Affected: 2.6.0 through 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.8
CVE-2018-14719	9.8	10%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from… Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.7
CVE-2018-7489	9.8	20%	Feb 26	FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the… Affected: before 2.7.9.3; 2.8.0 before 2.8.11.1; 2.9.0 before 2.9.5
CVE-2017-15095	9.8	8%	Feb 6	A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: before 2.8.10; before 2.9.1
CVE-2017-7525	9.8	38%	Feb 6	A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: before 2.6.7.1; before 2.7.9.1; before 2.8.9
CVE-2017-17485	9.8	50%	Jan 10	FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization… Affected: before 2.6.7.3; 2.7.0 before 2.7.9.2; 2.8.0 before 2.8.11; 2.9.0 before 2.9.4
CVE-2020-11113	8.8	6%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 2.0.0 before 2.9.10.4
CVE-2020-11112	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.9.10.4
CVE-2020-11111	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: 2.9.0 before 2.9.10.4
CVE-2020-10969	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 2.7.0 before 2.7.9.7; 2.8.0 before 2.8.11.6; 2.9.0 before 2.9.10.4
CVE-2020-10968	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 2.9.0 before 2.9.10.4
CVE-2020-10673	8.8	8%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 2.0.0 before 2.6.7.4; 2.9.0 before 2.9.10.4
CVE-2020-10672	8.8	3%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.9.0 before 2.9.10.4
CVE-2026-54512	8.1	1%	Jun 23	jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation Affected: >= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4
CVE-2026-54513	8.1	1%	Jun 23	jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) Affected: >= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4
CVE-2020-10650	8.1	4%	Dec 26	A deserialization flaw was discovered in jackson-databind through 2.9.10.4 Affected: before 2.9.10.4; 2.10.0; 2.10.0; 2.10.0
CVE-2021-20190	8.1	8%	Jan 19	A flaw was found in jackson-databind before 2.9.10.7 Affected: before 2.6.7.5; 2.7.0 before 2.9.10.7
CVE-2020-36182	8.1	4%	Jan 7	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36180	8.1	4%	Jan 7	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36179	8.1	17%	Jan 7	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36184	8.1	8%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36181	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36183	8.1	5%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36185	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36186	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36187	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36188	8.1	9%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-36189	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8
CVE-2020-35728	8.1	13%	Dec 27	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8