Package · Ubuntu

jackson-databind

86 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

Medium 5.3

CVE-2026-54515 Public exploit

jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven

Jun 23, 2026
Medium 5.9

CVE-2019-12384 Public exploit EPSS 45%

Deserialization of Untrusted Data in FasterXML jackson-databind

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Jun 24, 2019
Medium 5.9

CVE-2019-12814 Public exploit EPSS 11%

Deserialization of untrusted data in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the class…

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Jun 19, 2019