Package · Debian

jackson-databind

83 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

High 8.1

CVE-2026-54512 Public exploit

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven

Jun 23, 2026
High 7.5

CVE-2020-36518 Public exploit

Deeply nested json in jackson-databind

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Mar 11, 2022
High 8.8

CVE-2020-36179 Public exploit EPSS 17%

Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Jan 6, 2021
High 8.8

CVE-2020-36180 Public exploit

Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Jan 6, 2021
High 8.8

CVE-2020-36184 Public exploit

Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Jan 6, 2021
High 8.1

CVE-2020-36188 Public exploit

Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Jan 6, 2021
High 8.1

CVE-2020-35728 Public exploit EPSS 13%

Serialization gadget exploit in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Dec 27, 2020
High 8.1

CVE-2020-24750 Public exploit

Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Sep 17, 2020
High 8.1

CVE-2020-24616 Public exploit

Code Injection in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Aug 25, 2020
High 8.1

CVE-2020-14195 Public exploit

Deserialization of untrusted data in Jackson Databind

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Jun 16, 2020
High 8.8

CVE-2020-11113 Public exploit

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Mar 31, 2020
High 8.8

CVE-2020-10673 Public exploit

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Mar 18, 2020
High 7.5

CVE-2019-14439 Public exploit EPSS 11%

Deserialization of untrusted data in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in …

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Jul 30, 2019
High 7.5

CVE-2019-12086 Public exploit EPSS 22%

Information exposure in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14…

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

May 17, 2019