FasterXML jackson-databind vulnerabilities

CVEs per yearBy the year they were published

1. 20182
2. 202616

Newest CVEs

• CVE-2026-110879

  jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

  FasterXML · jackson-databind

  Critical9.8
• CVE-2026-91777

  jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

  FasterXML · jackson-databind

  High7.5
• CVE-2026-91776

  jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID

  FasterXML · jackson-databind

  High7.5
• CVE-2026-68497

  jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

  FasterXML · jackson-databind

  High7.5
• CVE-2026-83557

  jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

  FasterXML · jackson-databind

  Medium5.6
• CVE-2026-19032

  jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

  FasterXML · jackson-databind

  Medium5.3
• CVE-2026-59889

  jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

  FasterXML · jackson-databind

  Medium6.5
• CVE-2026-59888

  jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

  FasterXML · jackson-databind

  Medium6.5
• CVE-2026-54518

  jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind

  FasterXML · jackson-databind

  Medium6.5
• CVE-2026-50193

  jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

  FasterXML · jackson-databind

  Medium6.3