com.fasterxml.jackson.core:jackson-databind vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-54517Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has @JsonView bypass for setterless creator properties CVE-2026-54516Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields CVE-2026-54515Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties CVE-2026-54514Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54513Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54512Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation CVE-2026-50193Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()CVE-2026-54518Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a @JsonView bypass for unwrapped creator parameters CVE-2021-46877Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode CVE-2022-42003Highcom.fasterxml.jackson.core:jackson-databind: Uncontrolled Resource Consumption in Jackson-databind CVE-2022-42004Highcom.fasterxml.jackson.core:jackson-databind: Uncontrolled Resource Consumption in FasterXML jackson-databind CVE-2020-10650Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind vulnerable to unsafe deserialization CVE-2020-36518Highcom.fasterxml.jackson.core:jackson-databind: Deeply nested json in jackson-databind CVE-2020-36189Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36187Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36188Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36183Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36184Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36180Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36181Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36185Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36179Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36182Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-24750Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-35728Highcom.fasterxml.jackson.core:jackson-databind: Serialization gadget exploit in jackson-databind

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo