FasterXML jackson-databind
18 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-110879 | 2.10.0 – < 2.18.12 ; 2.19.0 – < 2.21.8 ; 2.22.0 – < 2.22.4 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation… | CRITICAL 9.8 | |||
| CVE-2026-91777 | 2.5.0 – 2.18.10 ; 2.19.0 – 2.21.6 ; 2.22.0 – 2.22.2 | jackson-databind: quadratic forward-reference completion in Collection and Map deserializers | HIGH 7.5 | 0.5 % | ||
| CVE-2026-91776 | 2.0.0 – 2.18.10 ; 2.19.0 – 2.21.6 ; 2.22.0 – 2.22.2 | jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID | HIGH 7.5 | 0.5 % | ||
| CVE-2026-68497 | 2.0.0 – < 2.18.10 ; 2.19.0 – < 2.21.6 ; 2.22.0 – < 2.22.2 | jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service | HIGH 7.5 | 0.6 % | ||
| CVE-2026-83557 | 2.11.0 – < 2.18.10 ; 2.19.0 – < 2.21.6 ; 2.22.0 – < 2.22.2 | jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types | MEDIUM 5.6 | 0.7 % | ||
| CVE-2026-19032 | 2.8.0 – < 2.18.10 ; 2.19.0 – < 2.21.6 ; 2.22.0 – < 2.22.2 | jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-59889 | >= 2.0.0-RC1, < 2.18.9 ; >= 2.19.0, < 2.21.5 ; >= 2.22.0, < 2.22.1 ; … | jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-59888 | >= 2.15.0, < 2.18.8 ; >= 2.19.0, < 2.21.4 ; >= 3.0.0, < 3.1.4 | jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-54518 | >= 2.21.0, < 2.21.4 ; >= 3.0.0, < 3.1.4 | jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-50193 | >= 2.10.0, < 2.14.0 | jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() | MEDIUM 6.3 | 0.6 % | ||
| CVE-2026-54512 | >= 2.10.0, < 2.18.8 ; >= 2.19.0, < 2.21.4 ; >= 3.0.0, < 3.1.4 | jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation | HIGH 8.1 | 0.9 % | ||
| CVE-2026-54513 | >= 2.10.0, < 2.18.8 ; >= 2.19.0, < 2.21.4 ; >= 3.0.0, < 3.1.4 | jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) | HIGH 8.1 | 1.2 % | ||
| CVE-2026-54514 | >= 2.0.0, < 2.18.8 ; >= 2.19.0, < 2.21.4 ; >= 3.0.0, < 3.1.4 | jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-54515 | >= 2.8.0, < 2.18.9 ; >= 2.19.0, < 2.21.5 ; >= 3.1.0, < 3.1.4 | jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-54516 | >= 2.21.0, < 2.21.4 ; >= 3.0.0, < 3.1.4 | jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-54517 | >= 2.21.0, < 2.21.4 ; >= 3.0.0, < 3.1.4 | jackson-databind: @JsonView bypass for setterless creator properties | MEDIUM 5.3 | 0.4 % | ||
| CVE-2017-7525 | before 2.6.7.1 ; before 2.7.9.1 ; before 2.8.9 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica | CRITICAL 9.8 | 38 % | ||
| CVE-2017-15095 | before 2.8.10 ; before 2.9.1 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user | CRITICAL 9.8 | 8.4 % |