JA
Product
jackson-databind
86
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 27High 47Medium 12Low 0
Watch
Add jackson-databind to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11113 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 2.0.0 before 2.9.10.4 |
| CVE-2020-11112 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.9.10.4 |
| CVE-2020-11111 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: 2.9.0 before 2.9.10.4 |
| CVE-2020-10969 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 2.7.0 before 2.7.9.7; 2.8.0 before 2.8.11.6; 2.9.0 before 2.9.10.4 |
| CVE-2020-10968 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 2.9.0 before 2.9.10.4 |
| CVE-2020-10673 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 2.0.0 before 2.6.7.4; 2.9.0 before 2.9.10.4 |
| CVE-2020-10672 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.9.0 before 2.9.10.4 |
| CVE-2026-54512 | 8.1 | Jun 23 | jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation Affected: >= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4 |
| CVE-2026-54513 | 8.1 | Jun 23 | jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) Affected: >= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4 |
| CVE-2020-10650 | 8.1 | Dec 26 | A deserialization flaw was discovered in jackson-databind through 2.9.10.4 Affected: before 2.9.10.4; 2.10.0; 2.10.0; 2.10.0 |
| CVE-2021-20190 | 8.1 | Jan 19 | A flaw was found in jackson-databind before 2.9.10.7 Affected: before 2.6.7.5; 2.7.0 before 2.9.10.7 |
| CVE-2020-36182 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36180 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36179 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36184 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36181 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36183 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36185 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36186 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36187 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36188 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-36189 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.8 |
| CVE-2020-35490 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.9.10.8 |
| CVE-2020-35491 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.9.10.8 |
| CVE-2020-24750 | 8.1 | Sep 17 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.6.7.5; 2.7.0 before 2.9.10.6 |
| CVE-2020-24616 | 8.1 | Aug 25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka… Affected: 2.0.0 before 2.9.10.6 |
| CVE-2020-14195 | 8.1 | Jun 16 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka… Affected: 2.9.0 before 2.9.10.5 |
| CVE-2020-14060 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool… Affected: 2.0.0 before 2.9.10.5 |
| CVE-2020-14061 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory,… Affected: 2.9.0 before 2.9.10.5 |
| CVE-2020-14062 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.9.10.5 |
| CVE-2020-11620 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka… Affected: 2.9.0 before 2.9.10.4 |
| CVE-2020-11619 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.0.0 before 2.9.10.4 |
| CVE-2018-5968 | 8.1 | Jan 22 | FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and… Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.2; 2.8.0 before 2.8.11.1; 2.9.0 before 2.9.4 |
| CVE-2026-91777 | 7.5 | Sep 23 | jackson-databind: quadratic forward-reference completion in Collection and Map deserializers Affected: 2.5.0 through 2.18.10; 2.19.0 through 2.21.6; 2.22.0 through 2.22.2; 3.0.0 through 3.1.6; 3.2.0 through 3.2.2 |
| CVE-2026-91776 | 7.5 | Sep 23 | jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID Affected: 2.0.0 through 2.18.10; 2.19.0 through 2.21.6; 2.22.0 through 2.22.2; 3.0.0 through 3.1.6; 3.2.0 through 3.2.2 |
| CVE-2026-68497 | 7.5 | Sep 11 | jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service Affected: 2.0.0 before 2.18.10; 2.19.0 before 2.21.6; 2.22.0 before 2.22.2; 3.0.0 before 3.1.6; 3.2.0 before 3.2.2 |
| CVE-2026-50193 | 7.5 | Jun 23 | jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() Affected: >= 2.10.0, < 2.14.0 |
| CVE-2021-46877 | 7.5 | Mar 18 | jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon… Affected: 2.10.0 before 2.12.6; 2.13.0; 2.13.0; 2.13.0 |
| CVE-2022-42004 | 7.5 | Oct 2 | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested… Affected: before 2.12.7.1; 2.13.0 before 2.13.4 |
| CVE-2022-42003 | 7.5 | Oct 2 | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep… Affected: before 2.12.7.1; 2.13.0 before 2.13.4.1 |
| CVE-2020-36518 | 7.5 | Mar 11 | jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects Affected: before 2.12.6.1; 2.13.0 before 2.13.2.1 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: 2.6.0 before 2.6.7.4; 2.9.0 before 2.9.10.7; 2.10.0 before 2.10.5.1 |
| CVE-2019-14439 | 7.5 | Jul 30 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.6; 2.8.0 before 2.8.11.4; 2.9.0 before 2.9.9.2 |
| CVE-2019-12086 | 7.5 | May 17 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.6; 2.8.0 before 2.8.11.4; 2.9.0 before 2.9.9 |
| CVE-2018-12022 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 2.0.0 before 2.6.7.3; 2.7.0 before 2.7.9.4; 2.8.0 before 2.8.11.2; 2.9.0 before 2.9.6 |
| CVE-2018-12023 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 2.7.0 before 2.7.9.4; 2.8.0 before 2.8.11.2; 2.9.0 before 2.9.6 |
Showing 47