Jackson security vulnerabilities
Developer framework / library. Public CVE monitoring for Jackson. Vendor security advisories are linked on this page.
Built for Operators of this product.
31 public records · 0 security-fix timeline events. 1 published in the last 7 days. 30 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 3
- Medium 3
- Low 0
2026-08-067 issues2026-11-03
Known exploited
View all known exploitedRecently published
Browse catalog- Critical9.8jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declaredCheck if you run itEPSS 1.20%Oct 28, 2026
- High7.5jackson-databind quadratic forward-reference completionCheck if you run itEPSS 0.49%Sep 22, 2026
- High7.5jackson-databind retains every unknown raw type IDCheck if you run itEPSS 0.49%Sep 22, 2026
- Medium5.6Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)Check if you run itEPSS 0.72%Sep 1, 2026
- High7.5Duration XMLGregorianCalendar Unbounded Number Parse DoSCheck if you run itEPSS 0.63%Aug 21, 2026
- Medium5.3Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCheck if you run itEPSS 0.57%Aug 21, 2026
- Medium6.5jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCheck if you run itEPSS 0.35%Jul 10, 2026
- Medium6.5on a Record property is bypassed with a PropertyNamingStrategy in jackson-databind [CVE-2026-59888]Check if you run itEPSS 0.42%Jul 10, 2026
- Medium6.5@JsonView bypass for unwrapped creator parameters in jackson-databindCheck if you run itEPSS 0.35%Jun 16, 2026
- Medium5.3@JsonView bypass for setterless creator properties in jackson-databindCheck if you run itEPSS 0.38%Jun 16, 2026