JA
Product
jackson-databind
86
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 27High 47Medium 12Low 0
Watch
Add jackson-databind to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-14721 | 10.0 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class… Affected: 2.6.0 before 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.7; 2.7.0; 2.7.0; +7 more |
| CVE-2026-110879 New | 9.8 | Oct 28 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) Affected: 2.10.0 before 2.18.12; 2.19.0 before 2.21.8; 2.22.0 before 2.22.4; 3.0.0 before 3.1.8; 3.2.0 before 3.2.4 |
| CVE-2019-14893 | 9.8 | Mar 2 | A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the… Affected: 2.8.0 before 2.8.11.5; 2.9.0 before 2.9.10 |
| CVE-2019-14892 | 9.8 | Mar 2 | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using… Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10 |
| CVE-2020-9546 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.6; 2.9.0 before 2.9.10.4 |
| CVE-2020-9547 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.6; 2.9.0 before 2.9.10.4 |
| CVE-2020-9548 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.6; 2.9.0 before 2.9.10.4 |
| CVE-2020-8840 | 9.8 | Feb 10 | FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.5; 2.9.0 before 2.9.10.3 |
| CVE-2019-20330 | 9.8 | Jan 3 | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking Affected: 2.0.0 before 2.7.9.7; 2.8.0 before 2.8.11.5; 2.9.0 before 2.9.10.2 |
| CVE-2019-17531 | 9.8 | Oct 12 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10.1 |
| CVE-2019-17267 | 9.8 | Oct 6 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 2.0.0 before 2.8.11.5; 2.9.0 before 2.9.10 |
| CVE-2019-16943 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10.1 |
| CVE-2019-16942 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.8.0 before 2.8.11.5; 2.9.0 before 2.9.10.1 |
| CVE-2019-16335 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10 |
| CVE-2019-14540 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.8.11.5; 2.9.0 before 2.9.10 |
| CVE-2019-14379 | 9.8 | Jul 29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.6; 2.8.0 before 2.8.11.4; 2.9.0 before 2.9.9.2 |
| CVE-2018-11307 | 9.8 | Jul 9 | An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.4; 2.8.0 before 2.8.11.2; 2.9.0 before 2.9.6 |
| CVE-2018-19360 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic… Affected: 2.6.0 through 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.8 |
| CVE-2018-19361 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization Affected: 2.6.0 through 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.8 |
| CVE-2018-14718 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic… Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.7 |
| CVE-2018-14720 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from… Affected: 2.6.0 before 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.7; 2.7.0; 2.7.0; +7 more |
| CVE-2018-19362 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic… Affected: 2.6.0 through 2.6.7.2; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.8 |
| CVE-2018-14719 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from… Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.5; 2.8.0 before 2.8.11.3; 2.9.0 before 2.9.7 |
| CVE-2018-7489 | 9.8 | Feb 26 | FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the… Affected: before 2.7.9.3; 2.8.0 before 2.8.11.1; 2.9.0 before 2.9.5 |
| CVE-2017-15095 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: before 2.8.10; before 2.9.1 |
| CVE-2017-7525 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: before 2.6.7.1; before 2.7.9.1; before 2.8.9 |
| CVE-2017-17485 | 9.8 | Jan 10 | FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization… Affected: before 2.6.7.3; 2.7.0 before 2.7.9.2; 2.8.0 before 2.8.11; 2.9.0 before 2.9.4 |
Showing 27