| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationCVE-2026-54512 · GHSA-J3RV-43J4-C7QM |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind quadratic forward-reference completion CVE-2026-91777 · GHSA-CXP5-3PX4-PW24 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind retains every unknown raw type ID CVE-2026-91776 · GHSA-WV8Q-QHHJ-9H54 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-68497 · GHSA-Q4XH-88C3-WMH7 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513 · GHSA-RMJ7-2VXQ-3G9F |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54517 · GHSA-5HH8-Q8HV-FR38 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()CVE-2026-50193 · GHSA-3WRR-7QPF-2PRH |
com.fasterxml.jackson.core:jackson-databindOpenShift Developer Tools and Services/jenkins-2-plugins |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind has a @JsonView bypass for unwrapped creator parametersCVE-2026-54518 · GHSA-RCQC-6CW3-H962 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fieldsCVE-2026-54516 · GHSA-9FXM-VC8V-HJ55 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Deserialization of Untrusted Data in jackson-databindCVE-2018-19361 · GHSA-MX9V-GMH4-MGQW |
com.fasterxml.jackson.core:jackson-databindRed Hat JBoss A-MQ 6/jackson-databind |
MavenRed Hat |
Critical
|
Fix reported |
|
| Deserialization of Untrusted Data in jackson-databind due to polymorphic deserializationCVE-2018-19360 · GHSA-F9HV-MG5H-XCW9 |
com.fasterxml.jackson.core:jackson-databindRed Hat JBoss A-MQ 6/jackson-databind |
MavenRed Hat |
Critical
|
Fix reported |
|
| Arbitrary Code Execution in jackson-databindCVE-2018-14718 · GHSA-645P-88QH-W398 |
com.fasterxml.jackson.core:jackson-databindRed Hat JBoss Enterprise Application Platform 7/jackson-databind |
MavenRed Hat |
Critical
|
Fix reported |
|
| Arbitrary Code Execution in jackson-databindCVE-2018-14719 · GHSA-4GQ5-CH57-C2MG |
com.fasterxml.jackson.core:jackson-databindRed Hat JBoss Enterprise Application Platform 7/jackson-databind |
MavenRed Hat |
Critical
|
Fix reported |
|
| com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted DataCVE-2018-19362 · GHSA-C8HM-7HPQ-7JHG |
com.fasterxml.jackson.core:jackson-databindRed Hat JBoss A-MQ 6/jackson-databind |
MavenRed Hat |
Critical
|
Fix reported |
|
| jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CVCVE-2026-110879 |
Red Hat AMQ Broker 7/jackson-databindRed Hat Ceph Storage 7/liborc |
Red Hat |
High
|
No fix reported |
|
