FasterXML jackson-databind

14 known vulnerabilities in FasterXML jackson-databind, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-91777 CVSS 7.5 high Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the…
  • CVE-2026-91776 CVSS 7.5 high TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied…
  • CVE-2026-68497 CVSS 7.5 high jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw…
  • CVE-2026-83557 CVSS 5.6 medium DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an…
  • CVE-2026-19032 CVSS 5.3 medium jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In…
  • CVE-2026-59889 CVSS 6.5 medium jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until…
  • CVE-2026-59888 CVSS 6.5 medium jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until…
  • CVE-2026-54518 CVSS 6.5 medium jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until…
  • CVE-2026-54517 CVSS 5.3 medium jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until…
  • CVE-2026-54516 CVSS 5.3 medium jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until…
  • CVE-2026-54515 CVSS 5.3 medium jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until…
  • CVE-2026-54514 CVSS 5.3 medium jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until…
  • CVE-2026-54513 CVSS 8.1 high jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until…
  • CVE-2026-54512 CVSS 8.1 high jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until…