Vulnerabilities in FasterXML
34 resultsCVE-2017-7525—A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticaEPSS 37.7%CVE-2017-15095—A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated userEPSS 8.4%CVE-2026-54513HIGHjackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)EPSS 1.2%CVE-2026-110879CRITICALjackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)EPSS 1.2%CVE-2026-54512HIGHjackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationEPSS 1.1%CVE-2023-3894MEDIUMDOS in jackson-dataformats-textEPSS 0.9%CVE-2025-52999HIGHjackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested dataEPSS 0.8%CVE-2026-83557MEDIUMjackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base typesEPSS 0.7%CVE-2026-104016HIGHjackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryErrorEPSS 0.7%CVE-2026-68498HIGHjackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of serviceEPSS 0.7%CVE-2026-89407HIGHjackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSEPSS 0.6%CVE-2026-68497HIGHjackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceEPSS 0.6%CVE-2026-50193MEDIUMjackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()EPSS 0.6%CVE-2026-29062HIGHjackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource ExhaustionEPSS 0.6%CVE-2026-19032MEDIUMjackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.PathEPSS 0.6%CVE-2026-68496HIGHjackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of serviceEPSS 0.6%CVE-2026-68495HIGHjackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of serviceEPSS 0.6%CVE-2026-89425HIGHjackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growthEPSS 0.5%CVE-2026-91776HIGHjackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type IDEPSS 0.5%CVE-2026-91777HIGHjackson-databind: quadratic forward-reference completion in Collection and Map deserializersEPSS 0.5%