Vulnerabilities in FasterXML
34 resultsCVE-2026-68494HIGHjackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)EPSS 0.5%CVE-2026-54516MEDIUMjackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fieldsEPSS 0.4%CVE-2026-54515MEDIUMjackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesEPSS 0.4%CVE-2026-59888MEDIUMjackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyEPSS 0.4%CVE-2025-49128MEDIUMJackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocationEPSS 0.4%CVE-2026-18401MEDIUMjackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of serviceEPSS 0.4%CVE-2026-110747HIGHjackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payloadEPSS 0.4%CVE-2026-54517MEDIUMjackson-databind: @JsonView bypass for setterless creator propertiesEPSS 0.4%CVE-2026-104895HIGHjackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of serviceEPSS 0.4%CVE-2026-54514MEDIUMjackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)EPSS 0.4%CVE-2026-54518MEDIUMjackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databindEPSS 0.4%CVE-2026-59889MEDIUMjackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserializationEPSS 0.3%CVE-2026-77310MEDIUMjackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)EPSS 0.3%CVE-2026-106554—jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)EPSS 0.2%