Jackson vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
31 matching records
- Critical9.8jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declaredCheck if you run itEPSS 1.20%Oct 28, 2026
- High7.5jackson-databind quadratic forward-reference completionCheck if you run itEPSS 0.49%Sep 22, 2026
- High7.5jackson-databind retains every unknown raw type IDCheck if you run itEPSS 0.49%Sep 22, 2026
- Medium5.6Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)Check if you run itEPSS 0.72%Sep 1, 2026
- High7.5Duration XMLGregorianCalendar Unbounded Number Parse DoSCheck if you run itEPSS 0.63%Aug 21, 2026
- Medium5.3Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCheck if you run itEPSS 0.57%Aug 21, 2026
- Medium5.3CVE-2026-77310 is listed by Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization (sibling of the patched InetSoc…Check if you run itEPSS 0.31%Aug 21, 2026
- Medium6.5jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCheck if you run itEPSS 0.35%Jul 10, 2026
- Medium6.5on a Record property is bypassed with a PropertyNamingStrategy in jackson-databind [CVE-2026-59888]Check if you run itEPSS 0.42%Jul 10, 2026
- Medium6.5GHSA-mhm7-754m-9p8w is listed by bypass for creator properties with.Open the advisoryJul 10, 2026
- Medium6.5@JsonView bypass for unwrapped creator parameters in jackson-databindCheck if you run itEPSS 0.35%Jun 16, 2026
- Medium5.3@JsonView bypass for setterless creator properties in jackson-databindCheck if you run itEPSS 0.38%Jun 16, 2026
- Medium5.3Renamed @JsonIgnore'd setters can deserialize via private fields in jackson-databindCheck if you run itEPSS 0.45%Jun 16, 2026
- Medium5.3Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties in jackson-databindCheck if you run itEPSS 0.44%Jun 16, 2026
- Medium5.3InetSocketAddress deserialization triggers eager DNS resolution (SSRF) in jackson-databindCheck if you run itEPSS 0.37%Jun 16, 2026
- High8.1Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) in jackson-databindCheck if you run itEPSS 1.23%Jun 16, 2026
- High8.1PolymorphicTypeValidator bypass via generic type parameters in jackson-databind allows arbitrary class instantiationCheck if you run itEPSS 1.07%Jun 16, 2026
- MediumDeeply nested JsonNode throws StackOverflowError for toString()Check if you run itEPSS 0.62%May 28, 2026
- High8.7jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor.Check if you run itEPSS 0.61%Mar 6, 2026
- High8.7jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor.Check if you run itEPSS 0.77%Jun 25, 2025
- Medium4.0Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor.Check if you run itEPSS 0.41%Jun 6, 2025
- Critical9.8fasterxml jackson-databind Deserialization of Untrusted DataPatch nowKEVEPSS 18.92%Mar 2, 2020
- Critical9.8fasterxml jackson-databind Deserialization of Untrusted DataPatch nowKEVEPSS 18.38%Mar 2, 2020
- UnknownFasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.Check this weekEPSS 26.59%Feb 10, 2020
- High7.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.Check if you run itEPSS 8.87%Mar 21, 2019