FasterXML vulnerabilities

CVEs per yearBy the year they were published

1. 20182
2. 20231
3. 20252
4. 202628

Newest CVEs

• CVE-2026-110879

  jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

  FasterXML · jackson-databind

  Critical9.8
• CVE-2026-110747

  jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload

  FasterXML · jackson-dataformat-protobuf

  High7.5
• CVE-2026-104895

  jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

  FasterXML · jackson-dataformat-smile

  High7.5
• CVE-2026-104016

  jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError

  FasterXML · jackson-dataformat-protobuf

  High7.5
• CVE-2026-68498

  jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service

  FasterXML · jackson-core

  High7.5
• CVE-2026-68496

  jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

  FasterXML · jackson-dataformats-binary

  High7.5
• CVE-2026-68495

  jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

  FasterXML · jackson-dataformats-binary

  High7.5
• CVE-2026-91777

  jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

  FasterXML · jackson-databind

  High7.5
• CVE-2026-91776

  jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID

  FasterXML · jackson-databind

  High7.5
• CVE-2026-89425

  jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

  FasterXML · jackson-core

  High7.5