Maven - OSV

GHSA-cxp5-3px4-pw24

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind quadratic forward-reference completion 30 Sep

Fix available
Severity - 7.5 (High)

GHSA-wv8q-qhhj-9h54

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind retains every unknown raw type ID 30 Sep

Fix available
Severity - 7.5 (High)

GHSA-gx83-3vf8-gh7j

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) 28 Sep

Fix available
Severity - 5.6 (Medium)

GHSA-q4xh-88c3-wmh7

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS 28 Sep

Fix available
Severity - 7.5 (High)

GHSA-wjgm-6hv5-3cvf

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution 28 Sep

Fix available
Severity - 5.3 (Medium)

GHSA-vvgp-rfg2-7rr6

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization 28 Sep

Fix available
Severity - 5.3 (Medium)

GHSA-5gvw-p9qm-jgwh

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on... 21 Jul

Fix available
Severity - 6.5 (Medium)

GHSA-mhm7-754m-9p8w

Maven/com.fasterxml.jackson.core:jackson-databind

jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)` 21 Jul

Fix available
Severity - 6.5 (Medium)

GHSA-3pjw-73gf-8qr5

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy 21 Jul

Fix available
Severity - 6.5 (Medium)

GHSA-5hh8-q8hv-fr38

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind has @JsonView bypass for setterless creator properties 23 Jun

Fix available
Severity - 5.3 (Medium)

GHSA-9fxm-vc8v-hj55

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields 23 Jun

Fix available
Severity - 5.3 (Medium)

GHSA-5jmj-h7xm-6q6v

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties 23 Jun

Fix available
Severity - 5.3 (Medium)

GHSA-hgj6-7826-r7m5

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) 23 Jun

Fix available
Severity - 5.3 (Medium)

GHSA-rmj7-2vxq-3g9f

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) 23 Jun

Fix available
Severity - 8.1 (High)

GHSA-j3rv-43j4-c7qm

Maven/com.fasterxml.jackson.core:jackson-databind
Maven/tools.jackson.core:jackson-databind

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation 23 Jun

Fix available
Severity - 8.1 (High)

GHSA-3wrr-7qpf-2prh

Maven/com.fasterxml.jackson.core:jackson-databind

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() 23 Jun

Fix available
Severity - 6.3 (Medium)

Vulnerabilities