| CVE-2026-110879 |
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its…
|
9.8
Critical
|
Oct 28, 2026 |
| CVE-2026-91777 |
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of…
|
7.5
High
|
Sep 23, 2026 |
| CVE-2026-91776 |
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw,…
|
7.5
High
|
Sep 23, 2026 |
| CVE-2026-68497 |
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field…
|
7.5
High
|
Sep 11, 2026 |
| CVE-2026-83557 |
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used…
|
5.6
Medium
|
Sep 1, 2026 |
| CVE-2026-19032 |
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI…
|
5.3
Medium
|
Sep 1, 2026 |
| CVE-2026-59889 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
6.5
Medium
|
Jul 14, 2026 |
| CVE-2026-59888 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
6.5
Medium
|
Jul 14, 2026 |
| CVE-2026-54518 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
6.5
Medium
|
Jun 23, 2026 |
| CVE-2026-50193 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
6.3
Medium
|
Jun 23, 2026 |
| CVE-2026-54512 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
8.1
High
|
Jun 23, 2026 |
| CVE-2026-54513 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
8.1
High
|
Jun 23, 2026 |
| CVE-2026-54514 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
5.3
Medium
|
Jun 23, 2026 |
| CVE-2026-54515 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
5.3
Medium
|
Jun 23, 2026 |
| CVE-2026-54516 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
5.3
Medium
|
Jun 23, 2026 |
| CVE-2026-54517 |
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
|
5.3
Medium
|
Jun 23, 2026 |
| CVE-2020-36179 |
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing,…
|
8.8
High
|
Jan 6, 2021 |
| CVE-2020-36180 |
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing,…
|
8.8
High
|
Jan 6, 2021 |
| CVE-2020-36182 |
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing,…
|
8.8
High
|
Jan 6, 2021 |
| CVE-2020-36184 |
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing,…
|
8.8
High
|
Jan 6, 2021 |
| CVE-2020-36181 |
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing,…
|
8.8
High
|
Jan 6, 2021 |
| CVE-2020-11111 |
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing,…
|
8.8
High
|
Mar 31, 2020 |
| CVE-2020-11112 |
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing,…
|
8.8
High
|
Mar 31, 2020 |
| CVE-2020-11113 |
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing,…
|
8.8
High
|
Mar 31, 2020 |
| CVE-2020-10968 |
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing,…
|
8.8
High
|
Mar 26, 2020 |