jackson-databind

3 results · Clear filters · Feed

• Medium 5.3
  CVE-2026-54515 Public exploit

  jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

  FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  Jun 23, 2026
• Medium 5.9
  CVE-2019-12384 Public exploit EPSS 45%

  Deserialization of Untrusted Data in FasterXML jackson-databind

  FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Jun 24, 2019
• Medium 5.9
  CVE-2019-12814 Public exploit EPSS 11%

  Deserialization of untrusted data in FasterXML jackson-databind

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the class…

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Jun 19, 2019