com.fasterxml.jackson.core:jackson-databind vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-91777Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind quadratic forward-reference completion CVE-2026-91776Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind retains every unknown raw type ID CVE-2026-83557Mediumtools.jackson.core:jackson-databind: jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator…CVE-2026-68497Hightools.jackson.core:jackson-databind: jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS CVE-2026-19032Mediumtools.jackson.core:jackson-databind: jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution CVE-2026-77310Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization CVE-2026-59889Mediumtools.jackson.core:jackson-databind: jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization GHSA-MHM7-754M-9P8WMediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`CVE-2026-59888Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy CVE-2026-54517Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has @JsonView bypass for setterless creator properties CVE-2026-54516Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields CVE-2026-54515Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties CVE-2026-54514Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54513Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54512Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation CVE-2026-50193Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()CVE-2026-54518Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a @JsonView bypass for unwrapped creator parameters CVE-2021-46877Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode CVE-2022-42003Highcom.fasterxml.jackson.core:jackson-databind: Uncontrolled Resource Consumption in Jackson-databind CVE-2022-42004Highcom.fasterxml.jackson.core:jackson-databind: Uncontrolled Resource Consumption in FasterXML jackson-databind CVE-2020-10650Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind vulnerable to unsafe deserialization CVE-2020-36518Highcom.fasterxml.jackson.core:jackson-databind: Deeply nested json in jackson-databind CVE-2020-36189Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36187Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind CVE-2020-36188Highcom.fasterxml.jackson.core:jackson-databind: Unsafe Deserialization in jackson-databind

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo