- Latest release
- 2.23.0 (Nov 8, 2026): no advisory affects it
- Newest unaffected release
- 2.23.0 (Nov 8, 2026), the latest release
- Advisories
- 86 · 8 critical, 27 high, 12 medium
- Dependents
- 4,955
- Releases
- 239 since 2.0.0 (Mar 25, 2012)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-110879Affects 2.10.0 to 2.18.11 (2.18.12 is outside it); 2.19.0 to 2.21.7 (2.21.8 is outside it); 2.22.0 to 2.22.3 (2.22.4 is outside it)
- CVE-2026-91777Affects 2.5.0 to 2.18.10 (2.18.11 is outside it); 2.19.0 to 2.21.6 (2.21.7 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it)
- CVE-2026-91776Affects 2.0.0 to 2.18.10 (2.18.11 is outside it); 2.19.0 to 2.21.6 (2.21.7 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it)
- CVE-2026-68497Affects 2.0.0 to 2.18.9 (2.18.10 is outside it); 2.19.0 to 2.21.5 (2.21.6 is outside it); 2.22.0 to 2.22.1 (2.22.2 is outside it)
- CVE-2026-83557Affects 2.11.0 to 2.18.9 (2.18.10 is outside it); 2.19.0 to 2.21.5 (2.21.6 is outside it); 2.22.0 to 2.22.1 (2.22.2 is outside it)
- CVE-2026-19032Affects 2.8.0 to 2.18.9 (2.18.10 is outside it); 2.19.0 to 2.21.5 (2.21.6 is outside it); 2.22.0 to 2.22.1 (2.22.2 is outside it)
- CVE-2026-77310Affects 2.0.0 to 2.18.8 (2.18.9 is outside it); 2.19.0 to 2.21.4 (2.21.5 is outside it); 2.22.0 (2.22.1 is outside it)
- CVE-2026-59889Affects 2.0.0-RC1 to 2.18.8 (2.18.9 is outside it); 2.19.0 to 2.21.4 (2.21.5 is outside it); 2.22.0 (2.22.1 is outside it)
- CVE-2026-59888Affects 2.15.0 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-54518Affects 2.21.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-50193Affects 2.10.0 to 2.14.0-rc3 (2.14.0 is outside it)
- CVE-2026-54512Affects 2.10.0 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it)
Show all 86 advisoriesShow fewer advisories
- CVE-2026-54513Affects 2.10.0 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-54514Affects 2.0.0 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-54515Affects 2.8.0 to 2.18.8 (2.18.9 is outside it); 2.19.0 to 2.21.4 (2.21.5 is outside it); 2.22.0 (2.22.1 is outside it)
- CVE-2026-54516Affects 2.21.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-54517Affects 2.21.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2021-46877Affects 2.10.0 to 2.12.5 (2.12.6 is outside it); 2.13.0 (2.13.1 is outside it)
- CVE-2020-10650Affects 2.0.0-RC1 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2022-42004Affects 2.4.0-rc1 to 2.12.7 (2.12.7.1 is outside it); 2.13.0 to 2.13.3 (2.13.4 is outside it)
- CVE-2022-42003Affects 2.4.0-rc1 to 2.12.7 (2.12.7.1 is outside it); 2.13.0 to 2.13.4.1 (2.13.4.2 is outside it)
- CVE-2020-36518Affects 2.0.0-RC1 to 2.12.6 (2.12.6.1 is outside it); 2.13.0 to 2.13.2 (2.13.2.1 is outside it)
- CVE-2021-20190Affects 2.0.0-RC1 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.6 (2.9.10.7 is outside it)
- CVE-2020-36179Affects 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36180Affects 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36182Affects 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36183Affects 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36184Affects 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36185Affects 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36186Affects 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36187Affects 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36188Affects 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36189Affects 2.0.0-RC1 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36181Affects 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-35728Affects 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-35490Affects 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-35491Affects 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-25649Affects 2.6.0 to 2.6.7.3 (2.6.7.4 is outside it); 2.7.0 to 2.9.10.6 (2.9.10.7 is outside it); 2.10.0 to 2.10.5 (2.10.5.1 is outside it)
- CVE-2020-24750Affects 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.5 (2.9.10.6 is outside it)
- CVE-2020-24616Affects 2.0.0 to 2.9.10.5 (2.9.10.6 is outside it)
- CVE-2020-14195Affects 2.9.0 to 2.9.10.4 (2.9.10.5 is outside it)
- CVE-2020-14060Affects 2.9.0 to 2.9.10.4 (2.9.10.5 is outside it)
- CVE-2020-14061Affects 2.9.0 to 2.9.10.4 (2.9.10.5 is outside it)
- CVE-2020-14062Affects 2.9.0 to 2.9.10.4 (2.9.10.5 is outside it)
- CVE-2020-11620Affects 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-11619Affects 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-11111Affects 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-11112Affects 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-11113Affects 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-10968Affects 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-10969Affects 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-10672Affects 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-10673Affects 2.0.0 to 2.6.7.3 (2.6.7.4 is outside it); 2.7.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2019-14893Affects 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2019-14892Affects 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2020-9546Affects 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-9547Affects 2.0.0 to 2.7.9.6 (2.7.9.7 is outside it); 2.8.0 to 2.8.11.5 (2.8.11.6 is outside it); 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-9548Affects 2.0.0 to 2.7.9.6 (2.7.9.7 is outside it); 2.8.0 to 2.8.11.5 (2.8.11.6 is outside it); 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-8840Affects 2.0.0 to 2.6.7.3 (2.6.7.4 is outside it); 2.7.0 to 2.7.9.6 (2.7.9.7 is outside it); 2.8.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10.2 (2.9.10.3 is outside it)
- CVE-2019-20330Affects 2.0.0 to 2.6.7.3 (2.6.7.4 is outside it); 2.7.0 to 2.7.9.6 (2.7.9.7 is outside it); 2.8.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10.1 (2.9.10.2 is outside it)
- CVE-2019-17531Affects 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10 (2.9.10.1 is outside it)
- CVE-2019-17267Affects 2.0.0-RC1 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2019-16943Affects 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10 (2.9.10.1 is outside it)
- CVE-2019-16942Affects 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10 (2.9.10.1 is outside it)
- CVE-2019-16335Affects 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2019-14540Affects 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2019-14439Affects 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.9.1 (2.9.9.2 is outside it)
- CVE-2019-14379Affects 2.0.0-RC1 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.9.1 (2.9.9.2 is outside it)
- CVE-2018-11307Affects 2.0.0 to 2.7.9.3 (2.7.9.4 is outside it); 2.8.0 to 2.8.11.1 (2.8.11.2 is outside it); 2.9.0 to 2.9.5 (2.9.6 is outside it)
- CVE-2019-12384Affects 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.9 (2.9.9.1 is outside it)
- CVE-2019-12814Affects 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.9 (2.9.9.1 is outside it)
- CVE-2019-12086Affects 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.8 (2.9.9 is outside it)
- CVE-2018-12022Affects 2.0.0-RC1 to 2.7.9.3 (2.7.9.4 is outside it); 2.8.0 to 2.8.11.1 (2.8.11.2 is outside it); 2.9.0 to 2.9.5 (2.9.6 is outside it)
- CVE-2018-12023Affects 2.7.0 to 2.7.9.3 (2.7.9.4 is outside it); 2.8.0 to 2.8.11.1 (2.8.11.2 is outside it); 2.9.0 to 2.9.5 (2.9.6 is outside it)
- CVE-2018-19362Affects 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.7 (2.9.8 is outside it)
- CVE-2018-19361Affects 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.7 (2.9.8 is outside it)
- CVE-2018-19360Affects 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.7 (2.9.8 is outside it)
- CVE-2018-14721Affects 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.6 (2.9.7 is outside it)
- CVE-2018-14720Affects 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.6 (2.9.7 is outside it)
- CVE-2018-14719Affects 2.0.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.6 (2.9.7 is outside it)
- CVE-2018-14718Affects 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.6 (2.9.7 is outside it)
- CVE-2018-7489Affects 2.0.0-RC1 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.7.9.2 (2.7.9.3 is outside it); 2.8.0 to 2.8.11 (2.8.11.1 is outside it); 2.9.0 to 2.9.4 (2.9.5 is outside it)
- CVE-2017-7525Affects 2.0.0-RC1 to 2.6.7 (2.6.7.1 is outside it); 2.7.0 to 2.7.9 (2.7.9.1 is outside it); 2.8.0 to 2.8.8.1 (2.8.9 is outside it)
- CVE-2017-15095Affects 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.1 (2.7.9.2 is outside it); 2.8.0 to 2.8.10 (2.8.11 is outside it); 2.9.0 to 2.9.3 (2.9.4 is outside it)
- CVE-2018-5968Affects 2.0.0-RC1 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11 (2.8.11.1 is outside it); 2.9.0 to 2.9.3 (2.9.4 is outside it)
- CVE-2017-17485Affects 2.0.0-RC1 to 2.7.9.1 (2.7.9.2 is outside it); 2.8.0 to 2.8.10 (2.8.11 is outside it); 2.9.0 to 2.9.3 (2.9.4 is outside it)
Advisories 86
- CVE-2026-110879Critical 9.8
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation…
Affected: from 2.10.0, fixed in 2.18.12; from 2.19.0, fixed in 2.21.8; from 2.22.0, fixed in 2.22.4.
Fixed in 2.18.12 (released Oct 17, 2026, 11 days before disclosure), 2.21.8 (released Oct 17, 2026, 11 days before disclosure) and 2.22.4 (released Oct 17, 2026, 11 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-91777High 7.5
jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
Affected: from 2.5.0, through 2.18.10; from 2.19.0, through 2.21.6; from 2.22.0, through 2.22.2; from 2.19.0, fixed in 2.21.7; from 2.5.0, fixed in 2.18.11; from 2.22.0, fixed in 2.22.3.
Fixed in 2.18.11 (released Sep 20, 2026, 3 days before disclosure), 2.21.7 (released Sep 21, 2026, 2 days before disclosure) and 2.22.3 (released Sep 21, 2026, 2 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-91776High 7.5
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
Affected: from 2.0.0, through 2.18.10; from 2.19.0, through 2.21.6; from 2.22.0, through 2.22.2; from 2.0.0, fixed in 2.18.11; from 2.19.0, fixed in 2.21.7; from 2.22.0, fixed in 2.22.3.
Fixed in 2.18.11 (released Sep 20, 2026, 3 days before disclosure), 2.21.7 (released Sep 21, 2026, 2 days before disclosure) and 2.22.3 (released Sep 21, 2026, 2 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-68497High 7.5
jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
Affected: from 2.0.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2; from 2.14.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2.
Fixed in 2.18.10 (released Aug 16, 2026, 26 days before disclosure), 2.21.6 (released Aug 14, 2026, 28 days before disclosure) and 2.22.2 (released Aug 16, 2026, 26 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-83557Medium 5.6
jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
Affected: from 2.11.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2; from 2.11.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2.
Fixed in 2.18.10 (released Aug 16, 2026, 16 days before disclosure), 2.21.6 (released Aug 14, 2026, 18 days before disclosure) and 2.22.2 (released Aug 16, 2026, 16 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-19032Medium 5.3
jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
Affected: from 2.8.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2; from 2.8.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2.
Fixed in 2.18.10 (released Aug 16, 2026, 16 days before disclosure), 2.21.6 (released Aug 14, 2026, 18 days before disclosure) and 2.22.2 (released Aug 16, 2026, 16 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-77310Medium 5.3
jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
Affected: from 2.0.0, fixed in 2.18.9; from 2.19.0, fixed in 2.21.5; from 2.22.0, fixed in 2.22.1.
Fixed in 2.18.9 (released Jul 8, 2026, 47 days before disclosure), 2.21.5 (released Jul 7, 2026, 48 days before disclosure) and 2.22.1 (released Jul 7, 2026, 48 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-59889Medium 6.5
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
Affected: from 2.19.0, fixed in 2.21.5; from 2.0.0-RC1, fixed in 2.18.9; from 2.22.0, fixed in 2.22.1.
Fixed in 2.18.9 (released Jul 8, 2026, 6 days before disclosure), 2.21.5 (released Jul 7, 2026, 7 days before disclosure) and 2.22.1 (released Jul 7, 2026, 7 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-59888Medium 6.5
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Affected: from 2.15.0, fixed in 2.18.8; from 2.19.0, fixed in 2.21.4.
Fixed in 2.18.8 (released May 29, 2026, 46 days before disclosure) and 2.21.4 (released May 29, 2026, 46 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-54518Medium 6.5
jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind
Affected: from 2.21.0, fixed in 2.21.4.
Fixed in 2.21.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-50193Medium 6.3
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
Affected: from 2.10.0, fixed in 2.14.0.
Fixed in 2.14.0 (released Nov 5, 2022, 1326 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-54512High 8.1
jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
Affected: from 2.10.0, fixed in 2.18.8; from 3.0.0, fixed in 3.1.4; from 2.19.0, fixed in 2.21.4.
Fixed in 2.18.8 (released May 29, 2026, 25 days before disclosure) and 2.21.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-54513High 8.1
jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Affected: from 2.10.0, fixed in 2.18.8; from 2.19.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4.
Fixed in 2.18.8 (released May 29, 2026, 25 days before disclosure) and 2.21.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-54514Medium 5.3
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
Affected: from 2.0.0, fixed in 2.18.8; from 2.19.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4.
Fixed in 2.18.8 (released May 29, 2026, 25 days before disclosure) and 2.21.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-54515Medium 5.3
jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Affected: from 3.1.0, fixed in 3.1.4; from 2.8.0, fixed in 2.18.9; from 2.19.0, fixed in 2.21.5; from 2.22.0, fixed in 2.22.1.
Fixed in 2.18.9 (released Jul 8, 2026, 15 days after disclosure), 2.21.5 (released Jul 7, 2026, 14 days after disclosure) and 2.22.1 (released Jul 7, 2026, 14 days after disclosure).
The latest release, 2.23.0, is not affected.
Show all 86 advisoriesShow fewer advisories
- CVE-2026-54516Medium 5.3
jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields
Affected: from 2.21.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4.
Fixed in 2.21.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2026-54517Medium 5.3
jackson-databind: @JsonView bypass for setterless creator properties
Affected: from 2.21.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4.
Fixed in 2.21.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2021-46877High 7.5
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB…
Affected: from 2.10.0, fixed in 2.12.6; from 2.13.0, fixed in 2.13.1.
Fixed in 2.12.6 (released Dec 15, 2021, 458 days before disclosure) and 2.13.1 (released Dec 19, 2021, 454 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-10650High 8.1
A deserialization flaw was discovered in jackson-databind through 2.9.10.4.
Affected: fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 989 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2022-42004High 7.5
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFrom
Affected: from 2.4.0-rc1, fixed in 2.12.7.1; from 2.13.0, fixed in 2.13.4.
Fixed in 2.12.7.1 (released Oct 13, 2022, 11 days after disclosure) and 2.13.4 (released Sep 3, 2022, 29 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2022-42003High 7.5
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitiv
Affected: from 2.4.0-rc1, fixed in 2.12.7.1; from 2.13.0, fixed in 2.13.4.2.
Fixed in 2.12.7.1 (released Oct 13, 2022, 11 days after disclosure) and 2.13.4.2 (released Oct 13, 2022, 11 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36518High 7.5
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Affected: from 2.13.0, fixed in 2.13.2.1; fixed in 2.12.6.1.
Fixed in 2.12.6.1 (released Mar 27, 2022, 16 days after disclosure) and 2.13.2.1 (released Mar 25, 2022, 14 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2021-20190High 8.1
A flaw was found in jackson-databind before 2.9.10.7.
Affected: from 2.7.0, fixed in 2.9.10.7; fixed in 2.6.7.5.
Fixed in 2.6.7.5 (released Jun 22, 2021, 154 days after disclosure) and 2.9.10.7 (released Dec 2, 2020, 48 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36179High 8.8
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36180High 8.8
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36182High 8.8
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36183Unrated
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.or
Affected: from 2.7.00, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36184High 8.8
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.0.0, fixed in 2.9.10.8.
Fixed in 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36185Unrated
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to
Affected: from 2.0.0, fixed in 2.9.10.8.
Fixed in 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36186Unrated
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to
Affected: from 2.0.0, fixed in 2.9.10.8.
Fixed in 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36187Unrated
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to
Affected: from 2.0.0, fixed in 2.9.10.8.
Fixed in 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36188Unrated
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.
Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36189Unrated
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.
Affected: from 2.7.0, fixed in 2.9.10.8; fixed in 2.6.7.5.
Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-36181High 8.8
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-35728High 8.1
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.0.0, fixed in 2.9.10.8.
Fixed in 2.9.10.8 (released Jan 6, 2021, 10 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-35490Unrated
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.co
Affected: from 2.0.0, fixed in 2.9.10.8.
Fixed in 2.9.10.8 (released Jan 6, 2021, 20 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-35491Unrated
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.co
Affected: from 2.0.0, fixed in 2.9.10.8.
Fixed in 2.9.10.8 (released Jan 6, 2021, 20 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-25649Unrated
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.
Affected: from 2.6.0, fixed in 2.6.7.4; from 2.7.0.0, fixed in 2.9.10.7; from 2.10.0.0, fixed in 2.10.5.1.
Fixed in 2.6.7.4 (released Oct 25, 2020, 39 days before disclosure), 2.9.10.7 (released Dec 2, 2020, 1 day before disclosure) and 2.10.5.1 (released Dec 2, 2020, 1 day before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-24750Unrated
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.h
Affected: from 2.0, fixed in 2.6.7.5; from 2.7.0, fixed in 2.9.10.6.
Fixed in 2.6.7.5 (released Jun 22, 2021, 278 days after disclosure) and 2.9.10.6 (released Aug 24, 2020, 24 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-24616Unrated
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.antero
Affected: from 2.0.0, fixed in 2.9.10.6.
Fixed in 2.9.10.6 (released Aug 24, 2020, 1 day before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-14195Unrated
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity
Affected: from 2.9.0, fixed in 2.9.10.5.
Fixed in 2.9.10.5 (released Jun 22, 2020, 6 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-14060Unrated
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apac
Affected: from 2.9.0, fixed in 2.9.10.5.
Fixed in 2.9.10.5 (released Jun 22, 2020, 8 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-14061High 8.1
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.9.0, fixed in 2.9.10.5.
Fixed in 2.9.10.5 (released Jun 22, 2020, 8 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-14062Unrated
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.a
Affected: from 2.9.0, fixed in 2.9.10.5.
Fixed in 2.9.10.5 (released Jun 22, 2020, 8 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-11620Unrated
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.co
Affected: from 2.9.0, fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 4 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-11619Unrated
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springfra
Affected: from 2.9.0, fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 4 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-11111High 8.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.9.0, fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 11 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-11112High 8.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.9.0, fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 11 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-11113High 8.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.9.0, fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 11 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-10968High 8.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.9.0, fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 16 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-10969High 8.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.9.0, fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 16 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-10672High 8.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.9.0, fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 24 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-10673High 8.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
Affected: from 2.7.0, fixed in 2.9.10.4; from 2.0.0, fixed in 2.6.7.4.
Fixed in 2.6.7.4 (released Oct 25, 2020, 221 days after disclosure) and 2.9.10.4 (released Apr 11, 2020, 24 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2019-14893High 7.5
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserializat
Affected: from 2.9.0, fixed in 2.9.10.
Fixed in 2.9.10 (released Sep 21, 2019, 163 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2019-14892High 7.5
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization
Affected: fixed in 2.6.7.3; from 2.7.0, fixed in 2.8.11.5; from 2.9.0, fixed in 2.9.10.
Fixed in 2.6.7.3 (released Oct 16, 2019, 138 days before disclosure), 2.8.11.5 (released Feb 10, 2020, 21 days before disclosure) and 2.9.10 (released Sep 21, 2019, 163 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-9546Critical 9.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.ha
Affected: from 2.9.0, fixed in 2.9.10.4.
Fixed in 2.9.10.4 (released Apr 11, 2020, 40 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-9547Critical 9.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sq
Affected: from 2.9.0, fixed in 2.9.10.4; from 2.8.0, fixed in 2.8.11.6; from 2.0.0, fixed in 2.7.9.7.
Fixed in 2.7.9.7 (released Mar 10, 2020, 8 days after disclosure), 2.8.11.6 (released Mar 10, 2020, 8 days after disclosure) and 2.9.10.4 (released Apr 11, 2020, 40 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-9548Critical 9.8
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.antero
Affected: from 2.9.0, fixed in 2.9.10.4; from 2.8.0, fixed in 2.8.11.6; from 2.0.0, fixed in 2.7.9.7.
Fixed in 2.7.9.7 (released Mar 10, 2020, 8 days after disclosure), 2.8.11.6 (released Mar 10, 2020, 8 days after disclosure) and 2.9.10.4 (released Apr 11, 2020, 40 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2020-8840Unrated
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi
Affected: from 2.0.0, fixed in 2.6.7.4; from 2.7.0, fixed in 2.7.9.7; from 2.8.0, fixed in 2.8.11.5; from 2.9.0, fixed in 2.9.10.3.
Fixed in 2.6.7.4 (released Oct 25, 2020, 258 days after disclosure), 2.7.9.7 (released Mar 10, 2020, 29 days after disclosure), 2.8.11.5 (released Feb 10, 2020, the day of disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2019-20330Critical 9.8
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
Affected: from 2.0.0, fixed in 2.6.7.4; from 2.7.0, fixed in 2.7.9.7; from 2.8.0, fixed in 2.8.11.5; from 2.9.0, fixed in 2.9.10.2.
Fixed in 2.6.7.4 (released Oct 25, 2020, 296 days after disclosure), 2.7.9.7 (released Mar 10, 2020, 67 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 38 days after disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2019-17531Unrated
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
Affected: from 2.9.0, fixed in 2.9.10.1; from 2.7.0, fixed in 2.8.11.5; fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 4 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 121 days after disclosure) and 2.9.10.1 (released Oct 19, 2019, 7 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2019-17267Critical 9.8
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
Affected: from 2.9.0, fixed in 2.9.10; fixed in 2.8.11.5.
Fixed in 2.8.11.5 (released Feb 10, 2020, 127 days after disclosure) and 2.9.10 (released Sep 21, 2019, 15 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2019-16943Critical 9.8
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
Affected: from 2.9.0, fixed in 2.9.10.1; from 2.7.0, fixed in 2.8.11.5; fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 15 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 132 days after disclosure) and 2.9.10.1 (released Oct 19, 2019, 18 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2019-16942Unrated
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
Affected: from 2.9.0, fixed in 2.9.10.1; from 2.7.0, fixed in 2.8.11.5; from 2.0.0, fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 15 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 132 days after disclosure) and 2.9.10.1 (released Oct 19, 2019, 18 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2019-16335Unrated
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
Affected: from 2.9.0, fixed in 2.9.10; from 2.7.0, fixed in 2.8.11.5; fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 31 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 148 days after disclosure) and 2.9.10 (released Sep 21, 2019, 6 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2019-14540Unrated
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
Affected: from 2.9.0, fixed in 2.9.10; from 2.7.0, fixed in 2.8.11.5; fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 31 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 148 days after disclosure) and 2.9.10 (released Sep 21, 2019, 6 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2019-14439Unrated
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2.
Affected: from 2.9.0, fixed in 2.9.9.2; from 2.8.0, fixed in 2.8.11.4; from 2.7.0, fixed in 2.7.9.6; fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 78 days after disclosure), 2.7.9.6 (released Jul 26, 2019, 4 days before disclosure), 2.8.11.4 (released Jul 26, 2019, 4 days before disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2019-14379Unrated
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache
Affected: from 2.9.0, fixed in 2.9.9.2; from 2.8.0, fixed in 2.8.11.4; fixed in 2.7.9.6.
Fixed in 2.7.9.6 (released Jul 26, 2019, 3 days before disclosure), 2.8.11.4 (released Jul 26, 2019, 3 days before disclosure) and 2.9.9.2 (released Jul 27, 2019, 2 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2018-11307Unrated
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.
Affected: from 2.0.0, fixed in 2.7.9.4; from 2.8.0, fixed in 2.8.11.2; from 2.9.0, fixed in 2.9.6.
Fixed in 2.7.9.4 (released Jun 8, 2018, 396 days before disclosure), 2.8.11.2 (released Jun 8, 2018, 396 days before disclosure) and 2.9.6 (released Jun 12, 2018, 392 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2019-12384Unrated
FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-
Affected: from 2.9.0, fixed in 2.9.9.1; from 2.8.0, fixed in 2.8.11.4; from 2.7.0, fixed in 2.7.9.6; from 2.0.0, fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 114 days after disclosure), 2.7.9.6 (released Jul 26, 2019, 32 days after disclosure), 2.8.11.4 (released Jul 26, 2019, 32 days after disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2019-12814Medium 5.9
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.
Affected: from 2.9.0, fixed in 2.9.9.1; from 2.8.0, fixed in 2.8.11.4; from 2.7.0, fixed in 2.7.9.6; from 2.0.0, fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 119 days after disclosure), 2.7.9.6 (released Jul 26, 2019, 37 days after disclosure), 2.8.11.4 (released Jul 26, 2019, 37 days after disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2019-12086Unrated
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.
Affected: from 2.9.0, fixed in 2.9.9; from 2.8.0, fixed in 2.8.11.4; from 2.7.0, fixed in 2.7.9.6; from 2.0.0, fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 152 days after disclosure), 2.7.9.6 (released Jul 26, 2019, 70 days after disclosure), 2.8.11.4 (released Jul 26, 2019, 70 days after disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2018-12022Unrated
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
Affected: fixed in 2.7.9.4; from 2.8.0, fixed in 2.8.11.2; from 2.9.0, fixed in 2.9.6.
Fixed in 2.7.9.4 (released Jun 8, 2018, 282 days before disclosure), 2.8.11.2 (released Jun 8, 2018, 282 days before disclosure) and 2.9.6 (released Jun 12, 2018, 278 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2018-12023Unrated
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
Affected: from 2.7.0, fixed in 2.7.9.4; from 2.8.0, fixed in 2.8.11.2; from 2.9.0, fixed in 2.9.6.
Fixed in 2.7.9.4 (released Jun 8, 2018, 282 days before disclosure), 2.8.11.2 (released Jun 8, 2018, 282 days before disclosure) and 2.9.6 (released Jun 12, 2018, 278 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2018-19362Unrated
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common
Affected: from 2.9.0, fixed in 2.9.8; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5; from 2.0.0, fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 287 days after disclosure), 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2018-19361Unrated
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clas
Affected: from 2.7.0, fixed in 2.7.9.5; from 2.9.0, fixed in 2.9.8; from 2.8.0, fixed in 2.8.11.3.
Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.8 (released Dec 15, 2018, 18 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2018-19360Unrated
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transp
Affected: from 2.9.0, fixed in 2.9.8; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5.
Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.8 (released Dec 15, 2018, 18 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2018-14721Unrated
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging
Affected: from 2.9.0, fixed in 2.9.7; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5.
Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.7 (released Sep 19, 2018, 105 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2018-14720Unrated
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to bloc
Affected: from 2.9.0, fixed in 2.9.7; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5.
Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.7 (released Sep 19, 2018, 105 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2018-14719Unrated
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-
Affected: from 2.9.0, fixed in 2.9.7; from 2.8.0, fixed in 2.8.11.3; from 2.0.0, fixed in 2.7.9.5.
Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.7 (released Sep 19, 2018, 105 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2018-14718Unrated
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-
Affected: from 2.9.0, fixed in 2.9.7; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5; from 2.0.0, fixed in 2.6.7.3.
Fixed in 2.6.7.3 (released Oct 16, 2019, 287 days after disclosure), 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2018-7489Unrated
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because
Affected: from 2.8.0, fixed in 2.8.11.1; from 2.9.0, fixed in 2.9.5; from 2.7.0, fixed in 2.7.9.3; fixed in 2.6.7.5.
Fixed in 2.6.7.5 (released Jun 22, 2021, 1212 days after disclosure), 2.7.9.3 (released Feb 11, 2018, 15 days before disclosure), 2.8.11.1 (released Feb 11, 2018, 15 days before disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2017-7525Unrated
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica
Affected: fixed in 2.6.7.1; from 2.7.0, fixed in 2.7.9.1; from 2.8.0, fixed in 2.8.9.
Fixed in 2.6.7.1 (released Jul 11, 2017, 210 days before disclosure), 2.7.9.1 (released Apr 18, 2017, 294 days before disclosure) and 2.8.9 (released Jun 12, 2017, 239 days before disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2017-15095Unrated
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user
Affected: from 2.8.0, fixed in 2.8.11; from 2.9.0, fixed in 2.9.4; from 2.0.0, fixed in 2.6.7.3; from 2.7.0, fixed in 2.7.9.2.
Fixed in 2.6.7.3 (released Oct 16, 2019, 617 days after disclosure), 2.7.9.2 (released Dec 20, 2017, 48 days before disclosure), 2.8.11 (released Dec 24, 2017, 44 days before disclosure) and 1 other version.
The latest release, 2.23.0, is not affected.
- CVE-2018-5968Unrated
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix
Affected: from 2.8.0, fixed in 2.8.11.1; from 2.9.0, fixed in 2.9.4; fixed in 2.7.9.5.
Fixed in 2.7.9.5 (released Nov 23, 2018, 305 days after disclosure), 2.8.11.1 (released Feb 11, 2018, 20 days after disclosure) and 2.9.4 (released Jan 24, 2018, 2 days after disclosure).
The latest release, 2.23.0, is not affected.
- CVE-2017-17485Critical 9.8
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete…
Affected: from 2.9.0, fixed in 2.9.4; from 2.8.0, fixed in 2.8.11; fixed in 2.7.9.2.
Fixed in 2.7.9.2 (released Dec 20, 2017, 21 days before disclosure), 2.8.11 (released Dec 24, 2017, 17 days before disclosure) and 2.9.4 (released Jan 24, 2018, 14 days after disclosure).
The latest release, 2.23.0, is not affected.