tools.jackson.core:jackson-databind vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-59889Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization CVE-2026-59888Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy CVE-2026-54517Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has @JsonView bypass for setterless creator properties CVE-2026-54516Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields CVE-2026-54515Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties CVE-2026-54514Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54513Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54512Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation CVE-2026-54518Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a @JsonView bypass for unwrapped creator parameters

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo