fasterxml

Top products

The 15 most recently published vulnerabilities affecting fasterxml.

• CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind6.5Jun 23, 2026
• CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()7.5Jun 23, 2026
• CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation8.1Jun 23, 2026
• CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)8.1Jun 23, 2026
• CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)5.3Jun 23, 2026
• CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties5.3Jun 23, 2026
• CVE-2026-54516jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields5.3Jun 23, 2026
• CVE-2026-54517jackson-databind: @JsonView bypass for setterless creator properties5.3Jun 23, 2026
• CVE-2026-29062jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion7.5Mar 6, 2026
• CVE-2025-52999jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data5.3Jun 25, 2025
• CVE-2025-49128Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation4.0Jun 6, 2025
• CVE-2023-3894DOS in jackson-dataformats-text5.8Aug 8, 2023
• CVE-2023-35116jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that ...4.7Jun 14, 2023
• CVE-2021-46877jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving Jso...7.5Mar 18, 2023
• CVE-2020-10650A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.j...8.1Dec 26, 2022