Jackson-databind
This hub aggregates every CVE we track for Jackson-databind, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
86
CVEs tracked
26
Critical
47
High
0
In CISA KEV
Severity distribution
HIGH47CRITICAL26MEDIUM13
Monthly trend
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
8
2
0
5
2024-102026-09
Latest CVEs
The 15 most recently published vulnerabilities affecting Jackson-databind.
- CVE-2026-91777jackson-databind: quadratic forward-reference completion in Collection and Map deserializers7.5
- CVE-2026-91776jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID7.5
- CVE-2026-68497jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service7.5
- CVE-2026-83557jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types5.6
- CVE-2026-19032jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path5.3
- CVE-2026-59889jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization6.5
- CVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy6.5
- CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind6.5
- CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()7.5
- CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation8.1
- CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)8.1
- CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)5.3
- CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties5.3
- CVE-2026-54516jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields5.3
- CVE-2026-54517jackson-databind: @JsonView bypass for setterless creator properties5.3
Product normalization is registry-driven with AI assist and human review. How it works