en
FasterXML is an open-source software organization and maintainer community for the Jackson Java data-processing ecosystem. Its core mission is to provide reusable libraries for JSON and other data formats, including streaming APIs, data binding, serialization, and deserialization. The projects operate through a global open-source development community.
As of 09/15/2026, FasterXML recorded 16 security vulnerabilities in the last 90 days across 4 products, including 4 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, jackson-databind had the most security vulnerabilities in the FasterXML ecosystem, with 13 vulnerabilities—approximately 81.25% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-68497jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service | Exploitation statusPublic exploit | FixYes | Affected productjackson-databind | Published09/11/2026 | SeverityHigh |
CVE-2026-83557jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types | Exploitation statusPublic exploit | FixYes | Affected productjackson-databind | Published09/01/2026 | SeverityMedium |
CVE-2026-19032jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path | Exploitation statusPublic exploit | FixYes | Affected productjackson-databind | Published09/01/2026 | SeverityMedium |
CVE-2026-77310jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) | Exploitation statusNot known exploited | FixYes | Affected productcom.fasterxml.jackson.core:jackson-databind | Published08/24/2026 | SeverityMedium |
CVE-2026-68494jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) | Exploitation statusPublic exploit | FixYes | Affected productjackson-core | Published08/04/2026 | SeverityHigh |
CVE-2026-18401jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service | Exploitation statusPublic exploit | FixYes | Affected productjackson-core | Published08/04/2026 | SeverityMedium |
CVE-2026-59889jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization | Exploitation statusNot known exploited | FixYes | Affected productjackson-databind | Published07/14/2026 | SeverityMedium |
CVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy | Exploitation statusNot known exploited | FixYes | Affected productjackson-databind | Published07/14/2026 | SeverityMedium |
CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind | Exploitation statusNot known exploited | FixYes | Affected productjackson-databind | Published06/23/2026 | SeverityMedium |
CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() | Exploitation statusNot known exploited | FixYes | Affected productjackson-databind | Published06/23/2026 | SeverityMedium |
CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation | Exploitation statusPublic exploit | FixYes | Affected productjackson-databind | Published06/23/2026 | SeverityHigh |
CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) | Exploitation statusNot known exploited | FixYes | Affected productjackson-databind | Published06/23/2026 | SeverityHigh |
CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) | Exploitation statusNot known exploited | FixYes | Affected productjackson-databind | Published06/23/2026 | SeverityMedium |
CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties | Exploitation statusNot known exploited | FixYes | Affected productjackson-databind | Published06/23/2026 | SeverityMedium |
CVE-2026-54516jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields | Exploitation statusNot known exploited | FixYes | Affected productjackson-databind | Published06/23/2026 | SeverityMedium |
CVE-2026-54517jackson-databind: @JsonView bypass for setterless creator properties | Exploitation statusNot known exploited | FixYes | Affected productjackson-databind | Published06/23/2026 | SeverityMedium |
CVE-2026-29062jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion | Exploitation statusNot known exploited | FixYes | Affected productjackson-core | Published03/06/2026 | SeverityHigh |
CVE-2025-52999jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data | Exploitation statusNot known exploited | FixNot confirmed | Affected productjackson-core | Published06/25/2025 | SeverityHigh |
CVE-2025-49128Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation | Exploitation statusPublic exploit | FixYes | Affected productjackson-core | Published06/06/2025 | SeverityMedium |
CVE-2023-3894DOS in jackson-dataformats-text | Exploitation statusNot known exploited | FixYes | Affected productjackson-dataformats-text | Published08/08/2023 | SeverityMedium |
CVE-2023-35116 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/14/2023 | SeverityUnknown |
CVE-2021-46877 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/18/2023 | SeverityHigh |
CVE-2020-10650 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/26/2022 | SeverityHigh |
CVE-2022-42004 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/02/2022 | SeverityUnknown |
CVE-2022-42003 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/02/2022 | SeverityUnknown |
CVE-2022-40152Stack Buffer Overflow in Woodstox | Exploitation statusPublic exploit | FixYes | Affected productWoodstox | Published09/16/2022 | SeverityMedium |
CVE-2020-36518 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/11/2022 | SeverityHigh |
CVE-2020-28491Denial of Service (DoS) | Exploitation statusNot confirmed | FixYes | Affected productcom.fasterxml.jackson.dataformat:jackson-dataformat-cbor | Published02/18/2021 | SeverityHigh |
CVE-2021-20190 | Exploitation statusNot known exploited | FixNot confirmed | Affected productjackson-databind | Published01/19/2021 | SeverityHigh |
CVE-2020-36179 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-36180 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-36182 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-36183 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36184 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-36185 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36186 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36187 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36188 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36189 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36181 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-35728 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/27/2020 | SeverityHigh |
CVE-2020-35490 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/17/2020 | SeverityUnknown |
CVE-2020-35491 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/17/2020 | SeverityUnknown |
CVE-2020-25649 | Exploitation statusNot confirmed | FixNot confirmed | Affected productjackson-databind | Published12/03/2020 | SeverityUnknown |
CVE-2020-24750 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/17/2020 | SeverityUnknown |
CVE-2020-24616 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/25/2020 | SeverityUnknown |
CVE-2020-14195 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/16/2020 | SeverityUnknown |
CVE-2020-14060 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/14/2020 | SeverityUnknown |
CVE-2020-14061 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/14/2020 | SeverityHigh |
CVE-2020-14062 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/14/2020 | SeverityUnknown |
CVE-2020-11620 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/07/2020 | SeverityUnknown |
CVE-2020-11619 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/07/2020 | SeverityUnknown |
CVE-2020-11111 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/31/2020 | SeverityHigh |
CVE-2020-11112 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/31/2020 | SeverityHigh |
CVE-2020-11113 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/31/2020 | SeverityHigh |
CVE-2020-10968 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/26/2020 | SeverityHigh |
CVE-2020-10969 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/26/2020 | SeverityHigh |
CVE-2020-10672 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/18/2020 | SeverityHigh |
CVE-2020-10673 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/18/2020 | SeverityHigh |
CVE-2019-14893 | Exploitation statusNot confirmed | FixNot confirmed | Affected productjackson-databind | Published03/02/2020 | SeverityHigh |
CVE-2019-14892 | Exploitation statusNot confirmed | FixNot confirmed | Affected productjackson-databind | Published03/02/2020 | SeverityHigh |
CVE-2020-9546 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/02/2020 | SeverityUnknown |
CVE-2020-9547 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/02/2020 | SeverityUnknown |
CVE-2020-9548 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/02/2020 | SeverityUnknown |
CVE-2020-8840 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/10/2020 | SeverityUnknown |
CVE-2019-20330 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/03/2020 | SeverityUnknown |
CVE-2019-10172 | Exploitation statusNot confirmed | FixNot confirmed | Affected productjackson-mapper-asl | Published11/18/2019 | SeverityMedium |
CVE-2019-17531 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/12/2019 | SeverityUnknown |
CVE-2019-17267 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/06/2019 | SeverityUnknown |
CVE-2019-16943 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/01/2019 | SeverityUnknown |
CVE-2019-16942 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/01/2019 | SeverityUnknown |
CVE-2019-16335 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/15/2019 | SeverityUnknown |
CVE-2019-14540 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/15/2019 | SeverityUnknown |
CVE-2019-14439 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/30/2019 | SeverityUnknown |
CVE-2019-14379 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/29/2019 | SeverityUnknown |
CVE-2018-11307 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published07/09/2019 | SeverityUnknown |
CVE-2019-12384 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/24/2019 | SeverityUnknown |
CVE-2019-12814 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/19/2019 | SeverityMedium |
CVE-2019-12086 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/17/2019 | SeverityUnknown |
CVE-2018-12022 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/17/2019 | SeverityUnknown |
CVE-2018-12023 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/17/2019 | SeverityUnknown |
CVE-2018-19360 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-19362 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-14719 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-14721 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-14718 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-19361 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-14720 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-1000873 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published12/20/2018 | SeverityUnknown |
CVE-2018-7489 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/26/2018 | SeverityUnknown |
CVE-2017-15095 | Exploitation statusNot confirmed | FixNot confirmed | Affected productjackson-databind | Published02/06/2018 | SeverityUnknown |
CVE-2017-7525 | Exploitation statusNot confirmed | FixNot confirmed | Affected productjackson-databind | Published02/06/2018 | SeverityUnknown |
CVE-2018-5968 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/22/2018 | SeverityUnknown |
CVE-2017-17485 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/10/2018 | SeverityCritical |
CVE-2016-7051 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/14/2017 | SeverityUnknown |
CVE-2016-3720 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/10/2016 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
