Jackson-databind
86 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Jackson-databind, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Jackson-databind CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 8 |
| 2026-07 | 2 |
| 2026-08 | 0 |
| 2026-09 | 5 |
Severity
How the 86 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical26
- High47
- Medium13
Latest CVEs
The 15 most recently published vulnerabilities affecting Jackson-databind.
- CVE-2026-91777jackson-databind: quadratic forward-reference completion in Collection and Map deserializers7.5
- CVE-2026-91776jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID7.5
- CVE-2026-68497jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service7.5
- CVE-2026-83557jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types5.6
- CVE-2026-19032jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path5.3
- CVE-2026-59889jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization6.5
- CVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy6.5
- CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind6.5
- CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()7.5
- CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation8.1
- CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)8.1
- CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)5.3
- CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties5.3
- CVE-2026-54516jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields5.3
- CVE-2026-54517jackson-databind: @JsonView bypass for setterless creator properties5.3
Product grouping is registry-driven, with AI assist and human review. How it works