jackson-databind
FasterXML
- Product type
- Other
- Catalog vulnerabilities
- 83
Severity across 15 analyzed records
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 09/15/2026, within CyStack's analyzed data, jackson-databind has 13 security vulnerabilities published in the last 90 days. Of these, 3 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of jackson-databind and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-68497jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service | Exploitation statusPublic exploit | FixYes | Published09/11/2026 | SeverityHigh |
CVE-2026-83557jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types | Exploitation statusPublic exploit | FixYes | Published09/01/2026 | SeverityMedium |
CVE-2026-19032jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path | Exploitation statusPublic exploit | FixYes | Published09/01/2026 | SeverityMedium |
CVE-2026-59889jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy | Exploitation statusNot known exploited | FixYes | Published07/14/2026 | SeverityMedium |
CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind | Exploitation statusNot known exploited | FixYes | Published06/23/2026 | SeverityMedium |
CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() | Exploitation statusNot known exploited | FixYes | Published06/23/2026 | SeverityMedium |
CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation | Exploitation statusPublic exploit | FixYes | Published06/23/2026 | SeverityHigh |
CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) | Exploitation statusNot known exploited | FixYes | Published06/23/2026 | SeverityHigh |
CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) | Exploitation statusNot known exploited | FixYes | Published06/23/2026 | SeverityMedium |
CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties | Exploitation statusNot known exploited | FixYes | Published06/23/2026 | SeverityMedium |
CVE-2026-54516jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields | Exploitation statusNot known exploited | FixYes | Published06/23/2026 | SeverityMedium |
CVE-2026-54517jackson-databind: @JsonView bypass for setterless creator properties | Exploitation statusNot known exploited | FixYes | Published06/23/2026 | SeverityMedium |
CVE-2023-35116 | Exploitation statusNot confirmed | FixNot confirmed | Published06/14/2023 | SeverityUnknown |
CVE-2021-46877 | Exploitation statusNot known exploited | FixNot confirmed | Published03/18/2023 | SeverityHigh |
CVE-2020-10650 | Exploitation statusPublic exploit | FixNot confirmed | Published12/26/2022 | SeverityHigh |
CVE-2022-42004 | Exploitation statusNot confirmed | FixNot confirmed | Published10/02/2022 | SeverityUnknown |
CVE-2022-42003 | Exploitation statusNot confirmed | FixNot confirmed | Published10/02/2022 | SeverityUnknown |
CVE-2020-36518 | Exploitation statusNot known exploited | FixNot confirmed | Published03/11/2022 | SeverityHigh |
CVE-2021-20190 | Exploitation statusNot known exploited | FixNot confirmed | Published01/19/2021 | SeverityHigh |
CVE-2020-36179 | Exploitation statusNot known exploited | FixNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-36180 | Exploitation statusNot known exploited | FixNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-36182 | Exploitation statusNot known exploited | FixNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-36183 | Exploitation statusNot confirmed | FixNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36184 | Exploitation statusNot known exploited | FixNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-36185 | Exploitation statusNot confirmed | FixNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36186 | Exploitation statusNot confirmed | FixNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36187 | Exploitation statusNot confirmed | FixNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36188 | Exploitation statusNot confirmed | FixNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36189 | Exploitation statusNot confirmed | FixNot confirmed | Published01/06/2021 | SeverityUnknown |
CVE-2020-36181 | Exploitation statusNot known exploited | FixNot confirmed | Published01/06/2021 | SeverityHigh |
CVE-2020-35728 | Exploitation statusNot known exploited | FixNot confirmed | Published12/27/2020 | SeverityHigh |
CVE-2020-35490 | Exploitation statusNot confirmed | FixNot confirmed | Published12/17/2020 | SeverityUnknown |
CVE-2020-35491 | Exploitation statusNot confirmed | FixNot confirmed | Published12/17/2020 | SeverityUnknown |
CVE-2020-25649 | Exploitation statusNot confirmed | FixNot confirmed | Published12/03/2020 | SeverityUnknown |
CVE-2020-24750 | Exploitation statusNot confirmed | FixNot confirmed | Published09/17/2020 | SeverityUnknown |
CVE-2020-24616 | Exploitation statusNot confirmed | FixNot confirmed | Published08/25/2020 | SeverityUnknown |
CVE-2020-14195 | Exploitation statusNot confirmed | FixNot confirmed | Published06/16/2020 | SeverityUnknown |
CVE-2020-14060 | Exploitation statusNot confirmed | FixNot confirmed | Published06/14/2020 | SeverityUnknown |
CVE-2020-14061 | Exploitation statusNot known exploited | FixNot confirmed | Published06/14/2020 | SeverityHigh |
CVE-2020-14062 | Exploitation statusNot confirmed | FixNot confirmed | Published06/14/2020 | SeverityUnknown |
CVE-2020-11620 | Exploitation statusNot confirmed | FixNot confirmed | Published04/07/2020 | SeverityUnknown |
CVE-2020-11619 | Exploitation statusNot confirmed | FixNot confirmed | Published04/07/2020 | SeverityUnknown |
CVE-2020-11111 | Exploitation statusNot known exploited | FixNot confirmed | Published03/31/2020 | SeverityHigh |
CVE-2020-11112 | Exploitation statusNot known exploited | FixNot confirmed | Published03/31/2020 | SeverityHigh |
CVE-2020-11113 | Exploitation statusNot known exploited | FixNot confirmed | Published03/31/2020 | SeverityHigh |
CVE-2020-10968 | Exploitation statusNot known exploited | FixNot confirmed | Published03/26/2020 | SeverityHigh |
CVE-2020-10969 | Exploitation statusNot known exploited | FixNot confirmed | Published03/26/2020 | SeverityHigh |
CVE-2020-10672 | Exploitation statusNot known exploited | FixNot confirmed | Published03/18/2020 | SeverityHigh |
CVE-2020-10673 | Exploitation statusNot known exploited | FixNot confirmed | Published03/18/2020 | SeverityHigh |
CVE-2019-14893 | Exploitation statusNot confirmed | FixNot confirmed | Published03/02/2020 | SeverityHigh |
CVE-2019-14892 | Exploitation statusNot confirmed | FixNot confirmed | Published03/02/2020 | SeverityHigh |
CVE-2020-9546 | Exploitation statusNot confirmed | FixNot confirmed | Published03/02/2020 | SeverityUnknown |
CVE-2020-9547 | Exploitation statusNot confirmed | FixNot confirmed | Published03/02/2020 | SeverityUnknown |
CVE-2020-9548 | Exploitation statusNot confirmed | FixNot confirmed | Published03/02/2020 | SeverityUnknown |
CVE-2020-8840 | Exploitation statusNot confirmed | FixNot confirmed | Published02/10/2020 | SeverityUnknown |
CVE-2019-20330 | Exploitation statusNot confirmed | FixNot confirmed | Published01/03/2020 | SeverityUnknown |
CVE-2019-17531 | Exploitation statusNot confirmed | FixNot confirmed | Published10/12/2019 | SeverityUnknown |
CVE-2019-17267 | Exploitation statusNot confirmed | FixNot confirmed | Published10/06/2019 | SeverityUnknown |
CVE-2019-16943 | Exploitation statusNot confirmed | FixNot confirmed | Published10/01/2019 | SeverityUnknown |
CVE-2019-16942 | Exploitation statusNot confirmed | FixNot confirmed | Published10/01/2019 | SeverityUnknown |
CVE-2019-16335 | Exploitation statusNot confirmed | FixNot confirmed | Published09/15/2019 | SeverityUnknown |
CVE-2019-14540 | Exploitation statusNot confirmed | FixNot confirmed | Published09/15/2019 | SeverityUnknown |
CVE-2019-14439 | Exploitation statusNot confirmed | FixNot confirmed | Published07/30/2019 | SeverityUnknown |
CVE-2019-14379 | Exploitation statusNot confirmed | FixNot confirmed | Published07/29/2019 | SeverityUnknown |
CVE-2018-11307 | Exploitation statusNot confirmed | FixYes | Published07/09/2019 | SeverityUnknown |
CVE-2019-12384 | Exploitation statusNot confirmed | FixNot confirmed | Published06/24/2019 | SeverityUnknown |
CVE-2019-12814 | Exploitation statusNot known exploited | FixNot confirmed | Published06/19/2019 | SeverityMedium |
CVE-2019-12086 | Exploitation statusNot confirmed | FixNot confirmed | Published05/17/2019 | SeverityUnknown |
CVE-2018-12022 | Exploitation statusNot confirmed | FixNot confirmed | Published03/17/2019 | SeverityUnknown |
CVE-2018-12023 | Exploitation statusNot confirmed | FixNot confirmed | Published03/17/2019 | SeverityUnknown |
CVE-2018-19360 | Exploitation statusNot confirmed | FixNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-19362 | Exploitation statusNot confirmed | FixNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-14719 | Exploitation statusNot confirmed | FixNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-14721 | Exploitation statusNot confirmed | FixNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-14718 | Exploitation statusNot confirmed | FixNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-19361 | Exploitation statusNot confirmed | FixNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-14720 | Exploitation statusNot confirmed | FixNot confirmed | Published01/02/2019 | SeverityUnknown |
CVE-2018-7489 | Exploitation statusNot confirmed | FixNot confirmed | Published02/26/2018 | SeverityUnknown |
CVE-2017-15095 | Exploitation statusNot confirmed | FixNot confirmed | Published02/06/2018 | SeverityUnknown |
CVE-2017-7525 | Exploitation statusNot confirmed | FixNot confirmed | Published02/06/2018 | SeverityUnknown |
CVE-2018-5968 | Exploitation statusNot confirmed | FixNot confirmed | Published01/22/2018 | SeverityUnknown |
CVE-2017-17485 | Exploitation statusNot known exploited | FixNot confirmed | Published01/10/2018 | SeverityCritical |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
