fasterxml
Top products
Latest CVEs
The 15 most recently published vulnerabilities affecting fasterxml.
- CVE-2026-91777jackson-databind: quadratic forward-reference completion in Collection and Map deserializers7.5
- CVE-2026-91776jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID7.5
- CVE-2026-89425jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth7.5
- CVE-2026-89407jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS7.5
- CVE-2026-68497jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service7.5
- CVE-2026-83557jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types5.6
- CVE-2026-19032jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path5.3
- CVE-2026-77310jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)5.3
- CVE-2026-68494jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
- CVE-2026-18401jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service
- CVE-2026-59889jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization6.5
- CVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy6.5
- CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind6.5
- CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()7.5
- CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation8.1