A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

Summary

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Timeline

1. Dec 3, 2020, 4:16 PM UTCCVE published
2. Oct 8, 2026, 7:35 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 8, 2026, 7:42 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a jackson-databind

  jackson-databind-2.11.0

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.6.0 · fixed in 2.6.7.4

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.7.0.0 · fixed in 2.9.10.7

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.10.0.0 · fixed in 2.10.5.1

References 25