FA
Vendor
FasterXML
106
CVEs
0
On KEV
7
New 30D
Products
JA10.0
jackson-databind
FasterXML
86 CVEs0 on KEV1 new
JA7.5
jackson-dataformats-binary
FasterXML
3 CVEs0 on KEV2 new
JA7.5
jackson-dataformat-protobuf
FasterXML
2 CVEs0 on KEV2 new
JA8.7
jackson-core
FasterXML
6 CVEs0 on KEV1 new
JA7.5
jackson-dataformat-smile
FasterXML
1 CVEs0 on KEV1 new
JA9.8
Jackson-dataformat-xml
Fasterxml
2 CVEs0 on KEV0 new
CO5.3
com.fasterxml.jackson.core:jackson-databind
FasterXML
1 CVEs0 on KEV0 new
JA7.5
Jackson-dataformats-text
Fasterxml
1 CVEs0 on KEV0 new
JA7.5
Jackson-mapper-asl
Fasterxml
1 CVEs0 on KEV0 new
JA6.5
Jackson-modules-java8
Fasterxml
1 CVEs0 on KEV0 new
TO5.3
tools.jackson.core:jackson-databind
FasterXML
1 CVEs0 on KEV0 new
WO7.5
Woodstox
Fasterxml
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110879 New | JA jackson-databind FasterXML | 9.8 | Oct 28 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) |
| CVE-2026-110747 New | JA jackson-dataformat-protobuf FasterXML | 7.5 | Oct 28 | jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload |
| CVE-2026-104895 New | JA jackson-dataformat-smile FasterXML | 7.5 | Oct 28 | jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service |
| CVE-2026-104016 New | JA jackson-dataformat-protobuf FasterXML | 7.5 | Oct 27 | jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError |
| CVE-2026-68498 | JA jackson-core FasterXML | 7.5 | Oct 16 | jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service |
| CVE-2026-68496 | JA jackson-dataformats-binary FasterXML | 7.5 | Oct 1 | jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service |
| CVE-2026-68495 | JA jackson-dataformats-binary FasterXML | 7.5 | Oct 1 | jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service |
| CVE-2026-91777 | JA jackson-databind FasterXML | 7.5 | Sep 23 | jackson-databind: quadratic forward-reference completion in Collection and Map deserializers |
| CVE-2026-91776 | JA jackson-databind FasterXML | 7.5 | Sep 23 | jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID |
| CVE-2026-89425 | JA jackson-core FasterXML | 7.5 | Sep 23 | jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth |
| CVE-2026-89407 | JA jackson-core FasterXML | 7.5 | Sep 22 | jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS |
| CVE-2026-68497 | JA jackson-databind FasterXML | 7.5 | Sep 11 | jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service |
| CVE-2026-83557 | JA jackson-databind FasterXML | 5.6 | Sep 1 | jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types |
| CVE-2026-19032 | JA jackson-databind FasterXML | 5.3 | Sep 1 | jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path |
| CVE-2026-77310 | CO com.fasterxml.jackson.core:jackson-databind FasterXML | 5.3 | Aug 24 | jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) |
| CVE-2026-68494 | JA jackson-core FasterXML | 8.7 | Aug 4 | jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) |
| CVE-2026-18401 | JA jackson-core FasterXML | 6.9 | Aug 4 | jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service |
| CVE-2026-59889 | JA jackson-databind FasterXML | 6.5 | Jul 14 | jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization |
| CVE-2026-59888 | JA jackson-databind FasterXML | 6.5 | Jul 14 | jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy |
| CVE-2026-54518 | JA jackson-databind FasterXML | 6.5 | Jun 23 | jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind |
| CVE-2026-50193 | JA jackson-databind FasterXML | 7.5 | Jun 23 | jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() |
| CVE-2026-54512 | JA jackson-databind FasterXML | 8.1 | Jun 23 | jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation |
| CVE-2026-54513 | JA jackson-databind FasterXML | 8.1 | Jun 23 | jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) |
| CVE-2026-54514 | JA jackson-databind FasterXML | 5.3 | Jun 23 | jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) |
| CVE-2026-54515 | JA jackson-databind FasterXML | 5.3 | Jun 23 | jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties |
| CVE-2026-54516 | JA jackson-databind FasterXML | 5.3 | Jun 23 | jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields |
| CVE-2026-54517 | JA jackson-databind FasterXML | 5.3 | Jun 23 | jackson-databind: @JsonView bypass for setterless creator properties |
| CVE-2026-29062 | JA Jackson-core Fasterxml | 7.5 | Mar 6 | jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor |
| CVE-2023-3894 | JA Jackson-dataformats-text Fasterxml | 7.5 | Aug 8 | Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS) |
| CVE-2023-35116 | JA Jackson-databind Fasterxml | 4.7 | Jun 14 | jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies |
| CVE-2021-46877 | JA Jackson-databind Fasterxml | 7.5 | Mar 18 | jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon… |
| CVE-2020-10650 | JA Jackson-databind Fasterxml | 8.1 | Dec 26 | A deserialization flaw was discovered in jackson-databind through 2.9.10.4 |
| CVE-2022-42004 | JA Jackson-databind Fasterxml | 7.5 | Oct 2 | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested… |
| CVE-2022-42003 | JA Jackson-databind Fasterxml | 7.5 | Oct 2 | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep… |
| CVE-2022-40152 | WO Woodstox Fasterxml | 7.5 | Sep 16 | Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled |
| CVE-2020-36518 | JA Jackson-databind Fasterxml | 7.5 | Mar 11 | jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects |
| CVE-2020-28491 | JA Jackson-dataformats-binary Fasterxml | 7.5 | Feb 18 | This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1 |
| CVE-2021-20190 | JA Jackson-databind Fasterxml | 8.1 | Jan 19 | A flaw was found in jackson-databind before 2.9.10.7 |
| CVE-2020-36182 | JA Jackson-databind Fasterxml | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36180 | JA Jackson-databind Fasterxml | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36179 | JA Jackson-databind Fasterxml | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36184 | JA Jackson-databind Fasterxml | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36181 | JA Jackson-databind Fasterxml | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36183 | JA Jackson-databind Fasterxml | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36185 | JA Jackson-databind Fasterxml | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36186 | JA Jackson-databind Fasterxml | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36187 | JA Jackson-databind Fasterxml | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36188 | JA Jackson-databind Fasterxml | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-36189 | JA Jackson-databind Fasterxml | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-35728 | JA Jackson-databind Fasterxml | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-35490 | JA Jackson-databind Fasterxml | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-35491 | JA Jackson-databind Fasterxml | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-25649 | JA Jackson-databind Fasterxml | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly |
| CVE-2020-24750 | JA Jackson-databind Fasterxml | 8.1 | Sep 17 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-24616 | JA Jackson-databind Fasterxml | 8.1 | Aug 25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka… |
| CVE-2020-14195 | JA Jackson-databind Fasterxml | 8.1 | Jun 16 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka… |
| CVE-2020-14060 | JA Jackson-databind Fasterxml | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool… |
| CVE-2020-14061 | JA Jackson-databind Fasterxml | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory,… |
| CVE-2020-14062 | JA Jackson-databind Fasterxml | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to… |
| CVE-2020-11620 | JA Jackson-databind Fasterxml | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka… |