# com.fasterxml.jackson.core:jackson-databind (Maven) vulnerabilities

86 known vulnerabilities (8 critical, 27 high, 12 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 2.23.0 (Nov 8, 2026): no advisory affects it
- Newest unaffected release: 2.23.0 (Nov 8, 2026), the latest release
- Dependents: 4,955
- Releases: 239 since 2.0.0 (Mar 25, 2012)
- Registry: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-databind
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-110879: 2.10.0 to 2.18.11 (2.18.12 is outside it); 2.19.0 to 2.21.7 (2.21.8 is outside it); 2.22.0 to 2.22.3 (2.22.4 is outside it)
- CVE-2026-91777: 2.5.0 to 2.18.10 (2.18.11 is outside it); 2.19.0 to 2.21.6 (2.21.7 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it)
- CVE-2026-91776: 2.0.0 to 2.18.10 (2.18.11 is outside it); 2.19.0 to 2.21.6 (2.21.7 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it)
- CVE-2026-68497: 2.0.0 to 2.18.9 (2.18.10 is outside it); 2.19.0 to 2.21.5 (2.21.6 is outside it); 2.22.0 to 2.22.1 (2.22.2 is outside it)
- CVE-2026-83557: 2.11.0 to 2.18.9 (2.18.10 is outside it); 2.19.0 to 2.21.5 (2.21.6 is outside it); 2.22.0 to 2.22.1 (2.22.2 is outside it)
- CVE-2026-19032: 2.8.0 to 2.18.9 (2.18.10 is outside it); 2.19.0 to 2.21.5 (2.21.6 is outside it); 2.22.0 to 2.22.1 (2.22.2 is outside it)
- CVE-2026-77310: 2.0.0 to 2.18.8 (2.18.9 is outside it); 2.19.0 to 2.21.4 (2.21.5 is outside it); 2.22.0 (2.22.1 is outside it)
- CVE-2026-59889: 2.0.0-RC1 to 2.18.8 (2.18.9 is outside it); 2.19.0 to 2.21.4 (2.21.5 is outside it); 2.22.0 (2.22.1 is outside it)
- CVE-2026-59888: 2.15.0 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-54518: 2.21.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-50193: 2.10.0 to 2.14.0-rc3 (2.14.0 is outside it)
- CVE-2026-54512: 2.10.0 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-54513: 2.10.0 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-54514: 2.0.0 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-54515: 2.8.0 to 2.18.8 (2.18.9 is outside it); 2.19.0 to 2.21.4 (2.21.5 is outside it); 2.22.0 (2.22.1 is outside it)
- CVE-2026-54516: 2.21.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2026-54517: 2.21.0 to 2.21.3 (2.21.4 is outside it)
- CVE-2021-46877: 2.10.0 to 2.12.5 (2.12.6 is outside it); 2.13.0 (2.13.1 is outside it)
- CVE-2020-10650: 2.0.0-RC1 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2022-42004: 2.4.0-rc1 to 2.12.7 (2.12.7.1 is outside it); 2.13.0 to 2.13.3 (2.13.4 is outside it)
- CVE-2022-42003: 2.4.0-rc1 to 2.12.7 (2.12.7.1 is outside it); 2.13.0 to 2.13.4.1 (2.13.4.2 is outside it)
- CVE-2020-36518: 2.0.0-RC1 to 2.12.6 (2.12.6.1 is outside it); 2.13.0 to 2.13.2 (2.13.2.1 is outside it)
- CVE-2021-20190: 2.0.0-RC1 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.6 (2.9.10.7 is outside it)
- CVE-2020-36179: 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36180: 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36182: 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36183: 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36184: 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36185: 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36186: 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36187: 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36188: 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36189: 2.0.0-RC1 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-36181: 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-35728: 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-35490: 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-35491: 2.0.0 to 2.9.10.7 (2.9.10.8 is outside it)
- CVE-2020-25649: 2.6.0 to 2.6.7.3 (2.6.7.4 is outside it); 2.7.0 to 2.9.10.6 (2.9.10.7 is outside it); 2.10.0 to 2.10.5 (2.10.5.1 is outside it)
- CVE-2020-24750: 2.0.0 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.9.10.5 (2.9.10.6 is outside it)
- CVE-2020-24616: 2.0.0 to 2.9.10.5 (2.9.10.6 is outside it)
- CVE-2020-14195: 2.9.0 to 2.9.10.4 (2.9.10.5 is outside it)
- CVE-2020-14060: 2.9.0 to 2.9.10.4 (2.9.10.5 is outside it)
- CVE-2020-14061: 2.9.0 to 2.9.10.4 (2.9.10.5 is outside it)
- CVE-2020-14062: 2.9.0 to 2.9.10.4 (2.9.10.5 is outside it)
- CVE-2020-11620: 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-11619: 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-11111: 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-11112: 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-11113: 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-10968: 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-10969: 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-10672: 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-10673: 2.0.0 to 2.6.7.3 (2.6.7.4 is outside it); 2.7.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2019-14893: 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2019-14892: 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2020-9546: 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-9547: 2.0.0 to 2.7.9.6 (2.7.9.7 is outside it); 2.8.0 to 2.8.11.5 (2.8.11.6 is outside it); 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-9548: 2.0.0 to 2.7.9.6 (2.7.9.7 is outside it); 2.8.0 to 2.8.11.5 (2.8.11.6 is outside it); 2.9.0 to 2.9.10.3 (2.9.10.4 is outside it)
- CVE-2020-8840: 2.0.0 to 2.6.7.3 (2.6.7.4 is outside it); 2.7.0 to 2.7.9.6 (2.7.9.7 is outside it); 2.8.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10.2 (2.9.10.3 is outside it)
- CVE-2019-20330: 2.0.0 to 2.6.7.3 (2.6.7.4 is outside it); 2.7.0 to 2.7.9.6 (2.7.9.7 is outside it); 2.8.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10.1 (2.9.10.2 is outside it)
- CVE-2019-17531: 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10 (2.9.10.1 is outside it)
- CVE-2019-17267: 2.0.0-RC1 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2019-16943: 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10 (2.9.10.1 is outside it)
- CVE-2019-16942: 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.10 (2.9.10.1 is outside it)
- CVE-2019-16335: 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2019-14540: 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.8.11.4 (2.8.11.5 is outside it); 2.9.0 to 2.9.9.3 (2.9.10 is outside it)
- CVE-2019-14439: 2.0.0-RC1 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.9.1 (2.9.9.2 is outside it)
- CVE-2019-14379: 2.0.0-RC1 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.9.1 (2.9.9.2 is outside it)
- CVE-2018-11307: 2.0.0 to 2.7.9.3 (2.7.9.4 is outside it); 2.8.0 to 2.8.11.1 (2.8.11.2 is outside it); 2.9.0 to 2.9.5 (2.9.6 is outside it)
- CVE-2019-12384: 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.9 (2.9.9.1 is outside it)
- CVE-2019-12814: 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.9 (2.9.9.1 is outside it)
- CVE-2019-12086: 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.5 (2.7.9.6 is outside it); 2.8.0 to 2.8.11.3 (2.8.11.4 is outside it); 2.9.0 to 2.9.8 (2.9.9 is outside it)
- CVE-2018-12022: 2.0.0-RC1 to 2.7.9.3 (2.7.9.4 is outside it); 2.8.0 to 2.8.11.1 (2.8.11.2 is outside it); 2.9.0 to 2.9.5 (2.9.6 is outside it)
- CVE-2018-12023: 2.7.0 to 2.7.9.3 (2.7.9.4 is outside it); 2.8.0 to 2.8.11.1 (2.8.11.2 is outside it); 2.9.0 to 2.9.5 (2.9.6 is outside it)
- CVE-2018-19362: 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.7 (2.9.8 is outside it)
- CVE-2018-19361: 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.7 (2.9.8 is outside it)
- CVE-2018-19360: 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.7 (2.9.8 is outside it)
- CVE-2018-14721: 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.6 (2.9.7 is outside it)
- CVE-2018-14720: 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.6 (2.9.7 is outside it)
- CVE-2018-14719: 2.0.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.6 (2.9.7 is outside it)
- CVE-2018-14718: 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11.2 (2.8.11.3 is outside it); 2.9.0 to 2.9.6 (2.9.7 is outside it)
- CVE-2018-7489: 2.0.0-RC1 to 2.6.7.4 (2.6.7.5 is outside it); 2.7.0 to 2.7.9.2 (2.7.9.3 is outside it); 2.8.0 to 2.8.11 (2.8.11.1 is outside it); 2.9.0 to 2.9.4 (2.9.5 is outside it)
- CVE-2017-7525: 2.0.0-RC1 to 2.6.7 (2.6.7.1 is outside it); 2.7.0 to 2.7.9 (2.7.9.1 is outside it); 2.8.0 to 2.8.8.1 (2.8.9 is outside it)
- CVE-2017-15095: 2.0.0 to 2.6.7.2 (2.6.7.3 is outside it); 2.7.0 to 2.7.9.1 (2.7.9.2 is outside it); 2.8.0 to 2.8.10 (2.8.11 is outside it); 2.9.0 to 2.9.3 (2.9.4 is outside it)
- CVE-2018-5968: 2.0.0-RC1 to 2.7.9.4 (2.7.9.5 is outside it); 2.8.0 to 2.8.11 (2.8.11.1 is outside it); 2.9.0 to 2.9.3 (2.9.4 is outside it)
- CVE-2017-17485: 2.0.0-RC1 to 2.7.9.1 (2.7.9.2 is outside it); 2.8.0 to 2.8.10 (2.8.11 is outside it); 2.9.0 to 2.9.3 (2.9.4 is outside it)

## Advisories (86)

### [CVE-2026-110879](https://cve.now/CVE-2026-110879): jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation…

- Severity: Critical 9.8
- Published: Oct 28, 2026
- Affected: from 2.10.0, fixed in 2.18.12; from 2.19.0, fixed in 2.21.8; from 2.22.0, fixed in 2.22.4.
- Fixed in 2.18.12 (released Oct 17, 2026, 11 days before disclosure), 2.21.8 (released Oct 17, 2026, 11 days before disclosure) and 2.22.4 (released Oct 17, 2026, 11 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-91777](https://cve.now/CVE-2026-91777): jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

- Severity: High 7.5
- Published: Sep 23, 2026
- Affected: from 2.5.0, through 2.18.10; from 2.19.0, through 2.21.6; from 2.22.0, through 2.22.2; from 2.19.0, fixed in 2.21.7; from 2.5.0, fixed in 2.18.11; from 2.22.0, fixed in 2.22.3.
- Fixed in 2.18.11 (released Sep 20, 2026, 3 days before disclosure), 2.21.7 (released Sep 21, 2026, 2 days before disclosure) and 2.22.3 (released Sep 21, 2026, 2 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-91776](https://cve.now/CVE-2026-91776): jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID

- Severity: High 7.5
- Published: Sep 23, 2026
- Affected: from 2.0.0, through 2.18.10; from 2.19.0, through 2.21.6; from 2.22.0, through 2.22.2; from 2.0.0, fixed in 2.18.11; from 2.19.0, fixed in 2.21.7; from 2.22.0, fixed in 2.22.3.
- Fixed in 2.18.11 (released Sep 20, 2026, 3 days before disclosure), 2.21.7 (released Sep 21, 2026, 2 days before disclosure) and 2.22.3 (released Sep 21, 2026, 2 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-68497](https://cve.now/CVE-2026-68497): jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

- Severity: High 7.5
- Published: Sep 11, 2026
- Affected: from 2.0.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2; from 2.14.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2.
- Fixed in 2.18.10 (released Aug 16, 2026, 26 days before disclosure), 2.21.6 (released Aug 14, 2026, 28 days before disclosure) and 2.22.2 (released Aug 16, 2026, 26 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-83557](https://cve.now/CVE-2026-83557): jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

- Severity: Medium 5.6
- Published: Sep 1, 2026
- Affected: from 2.11.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2; from 2.11.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2.
- Fixed in 2.18.10 (released Aug 16, 2026, 16 days before disclosure), 2.21.6 (released Aug 14, 2026, 18 days before disclosure) and 2.22.2 (released Aug 16, 2026, 16 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-19032](https://cve.now/CVE-2026-19032): jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

- Severity: Medium 5.3
- Published: Sep 1, 2026
- Affected: from 2.8.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2; from 2.8.0, fixed in 2.18.10; from 2.19.0, fixed in 2.21.6; from 2.22.0, fixed in 2.22.2.
- Fixed in 2.18.10 (released Aug 16, 2026, 16 days before disclosure), 2.21.6 (released Aug 14, 2026, 18 days before disclosure) and 2.22.2 (released Aug 16, 2026, 16 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-77310](https://cve.now/CVE-2026-77310): jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

- Severity: Medium 5.3
- Published: Aug 24, 2026
- Affected: from 2.0.0, fixed in 2.18.9; from 2.19.0, fixed in 2.21.5; from 2.22.0, fixed in 2.22.1.
- Fixed in 2.18.9 (released Jul 8, 2026, 47 days before disclosure), 2.21.5 (released Jul 7, 2026, 48 days before disclosure) and 2.22.1 (released Jul 7, 2026, 48 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-59889](https://cve.now/CVE-2026-59889): jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

- Severity: Medium 6.5
- Published: Jul 14, 2026
- Affected: from 2.19.0, fixed in 2.21.5; from 2.0.0-RC1, fixed in 2.18.9; from 2.22.0, fixed in 2.22.1.
- Fixed in 2.18.9 (released Jul 8, 2026, 6 days before disclosure), 2.21.5 (released Jul 7, 2026, 7 days before disclosure) and 2.22.1 (released Jul 7, 2026, 7 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-59888](https://cve.now/CVE-2026-59888): jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

- Severity: Medium 6.5
- Published: Jul 14, 2026
- Affected: from 2.15.0, fixed in 2.18.8; from 2.19.0, fixed in 2.21.4.
- Fixed in 2.18.8 (released May 29, 2026, 46 days before disclosure) and 2.21.4 (released May 29, 2026, 46 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-54518](https://cve.now/CVE-2026-54518): jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind

- Severity: Medium 6.5
- Published: Jun 23, 2026
- Affected: from 2.21.0, fixed in 2.21.4.
- Fixed in 2.21.4 (released May 29, 2026, 25 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-50193](https://cve.now/CVE-2026-50193): jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

- Severity: Medium 6.3
- Published: Jun 23, 2026
- Affected: from 2.10.0, fixed in 2.14.0.
- Fixed in 2.14.0 (released Nov 5, 2022, 1326 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-54512](https://cve.now/CVE-2026-54512): jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

- Severity: High 8.1
- Published: Jun 23, 2026
- Affected: from 2.10.0, fixed in 2.18.8; from 3.0.0, fixed in 3.1.4; from 2.19.0, fixed in 2.21.4.
- Fixed in 2.18.8 (released May 29, 2026, 25 days before disclosure) and 2.21.4 (released May 29, 2026, 25 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-54513](https://cve.now/CVE-2026-54513): jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

- Severity: High 8.1
- Published: Jun 23, 2026
- Affected: from 2.10.0, fixed in 2.18.8; from 2.19.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4.
- Fixed in 2.18.8 (released May 29, 2026, 25 days before disclosure) and 2.21.4 (released May 29, 2026, 25 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-54514](https://cve.now/CVE-2026-54514): jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

- Severity: Medium 5.3
- Published: Jun 23, 2026
- Affected: from 2.0.0, fixed in 2.18.8; from 2.19.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4.
- Fixed in 2.18.8 (released May 29, 2026, 25 days before disclosure) and 2.21.4 (released May 29, 2026, 25 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-54515](https://cve.now/CVE-2026-54515): jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

- Severity: Medium 5.3
- Published: Jun 23, 2026
- Affected: from 3.1.0, fixed in 3.1.4; from 2.8.0, fixed in 2.18.9; from 2.19.0, fixed in 2.21.5; from 2.22.0, fixed in 2.22.1.
- Fixed in 2.18.9 (released Jul 8, 2026, 15 days after disclosure), 2.21.5 (released Jul 7, 2026, 14 days after disclosure) and 2.22.1 (released Jul 7, 2026, 14 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-54516](https://cve.now/CVE-2026-54516): jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields

- Severity: Medium 5.3
- Published: Jun 23, 2026
- Affected: from 2.21.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4.
- Fixed in 2.21.4 (released May 29, 2026, 25 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2026-54517](https://cve.now/CVE-2026-54517): jackson-databind: @JsonView bypass for setterless creator properties

- Severity: Medium 5.3
- Published: Jun 23, 2026
- Affected: from 2.21.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4.
- Fixed in 2.21.4 (released May 29, 2026, 25 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2021-46877](https://cve.now/CVE-2021-46877): jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB…

- Severity: High 7.5
- Published: Mar 18, 2023
- Affected: from 2.10.0, fixed in 2.12.6; from 2.13.0, fixed in 2.13.1.
- Fixed in 2.12.6 (released Dec 15, 2021, 458 days before disclosure) and 2.13.1 (released Dec 19, 2021, 454 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-10650](https://cve.now/CVE-2020-10650): A deserialization flaw was discovered in jackson-databind through 2.9.10.4.

- Severity: High 8.1
- Published: Dec 26, 2022
- Affected: fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 989 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2022-42004](https://cve.now/CVE-2022-42004): In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.\_deserializeFrom

- Severity: High 7.5
- Published: Oct 2, 2022
- Affected: from 2.4.0-rc1, fixed in 2.12.7.1; from 2.13.0, fixed in 2.13.4.
- Fixed in 2.12.7.1 (released Oct 13, 2022, 11 days after disclosure) and 2.13.4 (released Sep 3, 2022, 29 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2022-42003](https://cve.now/CVE-2022-42003): In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitiv

- Severity: High 7.5
- Published: Oct 2, 2022
- Affected: from 2.4.0-rc1, fixed in 2.12.7.1; from 2.13.0, fixed in 2.13.4.2.
- Fixed in 2.12.7.1 (released Oct 13, 2022, 11 days after disclosure) and 2.13.4.2 (released Oct 13, 2022, 11 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36518](https://cve.now/CVE-2020-36518): jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

- Severity: High 7.5
- Published: Mar 11, 2022
- Affected: from 2.13.0, fixed in 2.13.2.1; fixed in 2.12.6.1.
- Fixed in 2.12.6.1 (released Mar 27, 2022, 16 days after disclosure) and 2.13.2.1 (released Mar 25, 2022, 14 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2021-20190](https://cve.now/CVE-2021-20190): A flaw was found in jackson-databind before 2.9.10.7.

- Severity: High 8.1
- Published: Jan 19, 2021
- Affected: from 2.7.0, fixed in 2.9.10.7; fixed in 2.6.7.5.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 154 days after disclosure) and 2.9.10.7 (released Dec 2, 2020, 48 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36179](https://cve.now/CVE-2020-36179): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Jan 6, 2021
- Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36180](https://cve.now/CVE-2020-36180): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Jan 6, 2021
- Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36182](https://cve.now/CVE-2020-36182): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Jan 6, 2021
- Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36183](https://cve.now/CVE-2020-36183): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.or

- Severity: Unrated
- Published: Jan 6, 2021
- Affected: from 2.7.00, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36184](https://cve.now/CVE-2020-36184): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Jan 6, 2021
- Affected: from 2.0.0, fixed in 2.9.10.8.
- Fixed in 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36185](https://cve.now/CVE-2020-36185): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to

- Severity: Unrated
- Published: Jan 6, 2021
- Affected: from 2.0.0, fixed in 2.9.10.8.
- Fixed in 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36186](https://cve.now/CVE-2020-36186): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to

- Severity: Unrated
- Published: Jan 6, 2021
- Affected: from 2.0.0, fixed in 2.9.10.8.
- Fixed in 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36187](https://cve.now/CVE-2020-36187): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to

- Severity: Unrated
- Published: Jan 6, 2021
- Affected: from 2.0.0, fixed in 2.9.10.8.
- Fixed in 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36188](https://cve.now/CVE-2020-36188): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.

- Severity: Unrated
- Published: Jan 6, 2021
- Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36189](https://cve.now/CVE-2020-36189): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.

- Severity: Unrated
- Published: Jan 6, 2021
- Affected: from 2.7.0, fixed in 2.9.10.8; fixed in 2.6.7.5.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-36181](https://cve.now/CVE-2020-36181): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Jan 6, 2021
- Affected: from 2.7.0, fixed in 2.9.10.8; from 2.0.0, fixed in 2.6.7.5.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 167 days after disclosure) and 2.9.10.8 (released Jan 6, 2021, the day of disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-35728](https://cve.now/CVE-2020-35728): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.1
- Published: Dec 27, 2020
- Affected: from 2.0.0, fixed in 2.9.10.8.
- Fixed in 2.9.10.8 (released Jan 6, 2021, 10 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-35490](https://cve.now/CVE-2020-35490): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.co

- Severity: Unrated
- Published: Dec 17, 2020
- Affected: from 2.0.0, fixed in 2.9.10.8.
- Fixed in 2.9.10.8 (released Jan 6, 2021, 20 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-35491](https://cve.now/CVE-2020-35491): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.co

- Severity: Unrated
- Published: Dec 17, 2020
- Affected: from 2.0.0, fixed in 2.9.10.8.
- Fixed in 2.9.10.8 (released Jan 6, 2021, 20 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-25649](https://cve.now/CVE-2020-25649): A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

- Severity: Unrated
- Published: Dec 3, 2020
- Affected: from 2.6.0, fixed in 2.6.7.4; from 2.7.0.0, fixed in 2.9.10.7; from 2.10.0.0, fixed in 2.10.5.1.
- Fixed in 2.6.7.4 (released Oct 25, 2020, 39 days before disclosure), 2.9.10.7 (released Dec 2, 2020, 1 day before disclosure) and 2.10.5.1 (released Dec 2, 2020, 1 day before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-24750](https://cve.now/CVE-2020-24750): FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.h

- Severity: Unrated
- Published: Sep 17, 2020
- Affected: from 2.0, fixed in 2.6.7.5; from 2.7.0, fixed in 2.9.10.6.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 278 days after disclosure) and 2.9.10.6 (released Aug 24, 2020, 24 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-24616](https://cve.now/CVE-2020-24616): FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.antero

- Severity: Unrated
- Published: Aug 25, 2020
- Affected: from 2.0.0, fixed in 2.9.10.6.
- Fixed in 2.9.10.6 (released Aug 24, 2020, 1 day before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-14195](https://cve.now/CVE-2020-14195): FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity

- Severity: Unrated
- Published: Jun 16, 2020
- Affected: from 2.9.0, fixed in 2.9.10.5.
- Fixed in 2.9.10.5 (released Jun 22, 2020, 6 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-14060](https://cve.now/CVE-2020-14060): FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apac

- Severity: Unrated
- Published: Jun 14, 2020
- Affected: from 2.9.0, fixed in 2.9.10.5.
- Fixed in 2.9.10.5 (released Jun 22, 2020, 8 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-14061](https://cve.now/CVE-2020-14061): FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.1
- Published: Jun 14, 2020
- Affected: from 2.9.0, fixed in 2.9.10.5.
- Fixed in 2.9.10.5 (released Jun 22, 2020, 8 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-14062](https://cve.now/CVE-2020-14062): FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.a

- Severity: Unrated
- Published: Jun 14, 2020
- Affected: from 2.9.0, fixed in 2.9.10.5.
- Fixed in 2.9.10.5 (released Jun 22, 2020, 8 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-11620](https://cve.now/CVE-2020-11620): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.co

- Severity: Unrated
- Published: Apr 7, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 4 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-11619](https://cve.now/CVE-2020-11619): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springfra

- Severity: Unrated
- Published: Apr 7, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 4 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-11111](https://cve.now/CVE-2020-11111): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Mar 31, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 11 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-11112](https://cve.now/CVE-2020-11112): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Mar 31, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 11 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-11113](https://cve.now/CVE-2020-11113): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Mar 31, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 11 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-10968](https://cve.now/CVE-2020-10968): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Mar 26, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 16 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-10969](https://cve.now/CVE-2020-10969): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Mar 26, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 16 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-10672](https://cve.now/CVE-2020-10672): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Mar 18, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 24 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-10673](https://cve.now/CVE-2020-10673): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…

- Severity: High 8.8
- Published: Mar 18, 2020
- Affected: from 2.7.0, fixed in 2.9.10.4; from 2.0.0, fixed in 2.6.7.4.
- Fixed in 2.6.7.4 (released Oct 25, 2020, 221 days after disclosure) and 2.9.10.4 (released Apr 11, 2020, 24 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2019-14893](https://cve.now/CVE-2019-14893): A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserializat

- Severity: High 7.5
- Published: Mar 2, 2020
- Affected: from 2.9.0, fixed in 2.9.10.
- Fixed in 2.9.10 (released Sep 21, 2019, 163 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2019-14892](https://cve.now/CVE-2019-14892): A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization

- Severity: High 7.5
- Published: Mar 2, 2020
- Affected: fixed in 2.6.7.3; from 2.7.0, fixed in 2.8.11.5; from 2.9.0, fixed in 2.9.10.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 138 days before disclosure), 2.8.11.5 (released Feb 10, 2020, 21 days before disclosure) and 2.9.10 (released Sep 21, 2019, 163 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-9546](https://cve.now/CVE-2020-9546): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.ha

- Severity: Critical 9.8
- Published: Mar 2, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4.
- Fixed in 2.9.10.4 (released Apr 11, 2020, 40 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-9547](https://cve.now/CVE-2020-9547): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sq

- Severity: Critical 9.8
- Published: Mar 2, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4; from 2.8.0, fixed in 2.8.11.6; from 2.0.0, fixed in 2.7.9.7.
- Fixed in 2.7.9.7 (released Mar 10, 2020, 8 days after disclosure), 2.8.11.6 (released Mar 10, 2020, 8 days after disclosure) and 2.9.10.4 (released Apr 11, 2020, 40 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-9548](https://cve.now/CVE-2020-9548): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.antero

- Severity: Critical 9.8
- Published: Mar 2, 2020
- Affected: from 2.9.0, fixed in 2.9.10.4; from 2.8.0, fixed in 2.8.11.6; from 2.0.0, fixed in 2.7.9.7.
- Fixed in 2.7.9.7 (released Mar 10, 2020, 8 days after disclosure), 2.8.11.6 (released Mar 10, 2020, 8 days after disclosure) and 2.9.10.4 (released Apr 11, 2020, 40 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2020-8840](https://cve.now/CVE-2020-8840): FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi

- Severity: Unrated
- Published: Feb 10, 2020
- Affected: from 2.0.0, fixed in 2.6.7.4; from 2.7.0, fixed in 2.7.9.7; from 2.8.0, fixed in 2.8.11.5; from 2.9.0, fixed in 2.9.10.3.
- Fixed in 2.6.7.4 (released Oct 25, 2020, 258 days after disclosure), 2.7.9.7 (released Mar 10, 2020, 29 days after disclosure), 2.8.11.5 (released Feb 10, 2020, the day of disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2019-20330](https://cve.now/CVE-2019-20330): FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

- Severity: Critical 9.8
- Published: Jan 3, 2020
- Affected: from 2.0.0, fixed in 2.6.7.4; from 2.7.0, fixed in 2.7.9.7; from 2.8.0, fixed in 2.8.11.5; from 2.9.0, fixed in 2.9.10.2.
- Fixed in 2.6.7.4 (released Oct 25, 2020, 296 days after disclosure), 2.7.9.7 (released Mar 10, 2020, 67 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 38 days after disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2019-17531](https://cve.now/CVE-2019-17531): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.

- Severity: Unrated
- Published: Oct 12, 2019
- Affected: from 2.9.0, fixed in 2.9.10.1; from 2.7.0, fixed in 2.8.11.5; fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 4 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 121 days after disclosure) and 2.9.10.1 (released Oct 19, 2019, 7 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2019-17267](https://cve.now/CVE-2019-17267): A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.

- Severity: Critical 9.8
- Published: Oct 6, 2019
- Affected: from 2.9.0, fixed in 2.9.10; fixed in 2.8.11.5.
- Fixed in 2.8.11.5 (released Feb 10, 2020, 127 days after disclosure) and 2.9.10 (released Sep 21, 2019, 15 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2019-16943](https://cve.now/CVE-2019-16943): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.

- Severity: Critical 9.8
- Published: Oct 1, 2019
- Affected: from 2.9.0, fixed in 2.9.10.1; from 2.7.0, fixed in 2.8.11.5; fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 15 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 132 days after disclosure) and 2.9.10.1 (released Oct 19, 2019, 18 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2019-16942](https://cve.now/CVE-2019-16942): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.

- Severity: Unrated
- Published: Oct 1, 2019
- Affected: from 2.9.0, fixed in 2.9.10.1; from 2.7.0, fixed in 2.8.11.5; from 2.0.0, fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 15 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 132 days after disclosure) and 2.9.10.1 (released Oct 19, 2019, 18 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2019-16335](https://cve.now/CVE-2019-16335): A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.

- Severity: Unrated
- Published: Sep 15, 2019
- Affected: from 2.9.0, fixed in 2.9.10; from 2.7.0, fixed in 2.8.11.5; fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 31 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 148 days after disclosure) and 2.9.10 (released Sep 21, 2019, 6 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2019-14540](https://cve.now/CVE-2019-14540): A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.

- Severity: Unrated
- Published: Sep 15, 2019
- Affected: from 2.9.0, fixed in 2.9.10; from 2.7.0, fixed in 2.8.11.5; fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 31 days after disclosure), 2.8.11.5 (released Feb 10, 2020, 148 days after disclosure) and 2.9.10 (released Sep 21, 2019, 6 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2019-14439](https://cve.now/CVE-2019-14439): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2.

- Severity: Unrated
- Published: Jul 30, 2019
- Affected: from 2.9.0, fixed in 2.9.9.2; from 2.8.0, fixed in 2.8.11.4; from 2.7.0, fixed in 2.7.9.6; fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 78 days after disclosure), 2.7.9.6 (released Jul 26, 2019, 4 days before disclosure), 2.8.11.4 (released Jul 26, 2019, 4 days before disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2019-14379](https://cve.now/CVE-2019-14379): SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache

- Severity: Unrated
- Published: Jul 29, 2019
- Affected: from 2.9.0, fixed in 2.9.9.2; from 2.8.0, fixed in 2.8.11.4; fixed in 2.7.9.6.
- Fixed in 2.7.9.6 (released Jul 26, 2019, 3 days before disclosure), 2.8.11.4 (released Jul 26, 2019, 3 days before disclosure) and 2.9.9.2 (released Jul 27, 2019, 2 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2018-11307](https://cve.now/CVE-2018-11307): An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.

- Severity: Unrated
- Published: Jul 9, 2019
- Affected: from 2.0.0, fixed in 2.7.9.4; from 2.8.0, fixed in 2.8.11.2; from 2.9.0, fixed in 2.9.6.
- Fixed in 2.7.9.4 (released Jun 8, 2018, 396 days before disclosure), 2.8.11.2 (released Jun 8, 2018, 396 days before disclosure) and 2.9.6 (released Jun 12, 2018, 392 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2019-12384](https://cve.now/CVE-2019-12384): FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-

- Severity: Unrated
- Published: Jun 24, 2019
- Affected: from 2.9.0, fixed in 2.9.9.1; from 2.8.0, fixed in 2.8.11.4; from 2.7.0, fixed in 2.7.9.6; from 2.0.0, fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 114 days after disclosure), 2.7.9.6 (released Jul 26, 2019, 32 days after disclosure), 2.8.11.4 (released Jul 26, 2019, 32 days after disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2019-12814](https://cve.now/CVE-2019-12814): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.

- Severity: Medium 5.9
- Published: Jun 19, 2019
- Affected: from 2.9.0, fixed in 2.9.9.1; from 2.8.0, fixed in 2.8.11.4; from 2.7.0, fixed in 2.7.9.6; from 2.0.0, fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 119 days after disclosure), 2.7.9.6 (released Jul 26, 2019, 37 days after disclosure), 2.8.11.4 (released Jul 26, 2019, 37 days after disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2019-12086](https://cve.now/CVE-2019-12086): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.

- Severity: Unrated
- Published: May 17, 2019
- Affected: from 2.9.0, fixed in 2.9.9; from 2.8.0, fixed in 2.8.11.4; from 2.7.0, fixed in 2.7.9.6; from 2.0.0, fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 152 days after disclosure), 2.7.9.6 (released Jul 26, 2019, 70 days after disclosure), 2.8.11.4 (released Jul 26, 2019, 70 days after disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2018-12022](https://cve.now/CVE-2018-12022): An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.

- Severity: Unrated
- Published: Mar 17, 2019
- Affected: fixed in 2.7.9.4; from 2.8.0, fixed in 2.8.11.2; from 2.9.0, fixed in 2.9.6.
- Fixed in 2.7.9.4 (released Jun 8, 2018, 282 days before disclosure), 2.8.11.2 (released Jun 8, 2018, 282 days before disclosure) and 2.9.6 (released Jun 12, 2018, 278 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2018-12023](https://cve.now/CVE-2018-12023): An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.

- Severity: Unrated
- Published: Mar 17, 2019
- Affected: from 2.7.0, fixed in 2.7.9.4; from 2.8.0, fixed in 2.8.11.2; from 2.9.0, fixed in 2.9.6.
- Fixed in 2.7.9.4 (released Jun 8, 2018, 282 days before disclosure), 2.8.11.2 (released Jun 8, 2018, 282 days before disclosure) and 2.9.6 (released Jun 12, 2018, 278 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2018-19362](https://cve.now/CVE-2018-19362): FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common

- Severity: Unrated
- Published: Jan 2, 2019
- Affected: from 2.9.0, fixed in 2.9.8; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5; from 2.0.0, fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 287 days after disclosure), 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2018-19361](https://cve.now/CVE-2018-19361): FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clas

- Severity: Unrated
- Published: Jan 2, 2019
- Affected: from 2.7.0, fixed in 2.7.9.5; from 2.9.0, fixed in 2.9.8; from 2.8.0, fixed in 2.8.11.3.
- Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.8 (released Dec 15, 2018, 18 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2018-19360](https://cve.now/CVE-2018-19360): FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transp

- Severity: Unrated
- Published: Jan 2, 2019
- Affected: from 2.9.0, fixed in 2.9.8; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5.
- Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.8 (released Dec 15, 2018, 18 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2018-14721](https://cve.now/CVE-2018-14721): FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging

- Severity: Unrated
- Published: Jan 2, 2019
- Affected: from 2.9.0, fixed in 2.9.7; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5.
- Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.7 (released Sep 19, 2018, 105 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2018-14720](https://cve.now/CVE-2018-14720): FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to bloc

- Severity: Unrated
- Published: Jan 2, 2019
- Affected: from 2.9.0, fixed in 2.9.7; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5.
- Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.7 (released Sep 19, 2018, 105 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2018-14719](https://cve.now/CVE-2018-14719): FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-

- Severity: Unrated
- Published: Jan 2, 2019
- Affected: from 2.9.0, fixed in 2.9.7; from 2.8.0, fixed in 2.8.11.3; from 2.0.0, fixed in 2.7.9.5.
- Fixed in 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 2.9.7 (released Sep 19, 2018, 105 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2018-14718](https://cve.now/CVE-2018-14718): FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-

- Severity: Unrated
- Published: Jan 2, 2019
- Affected: from 2.9.0, fixed in 2.9.7; from 2.8.0, fixed in 2.8.11.3; from 2.7.0, fixed in 2.7.9.5; from 2.0.0, fixed in 2.6.7.3.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 287 days after disclosure), 2.7.9.5 (released Nov 23, 2018, 40 days before disclosure), 2.8.11.3 (released Nov 23, 2018, 40 days before disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2018-7489](https://cve.now/CVE-2018-7489): FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because

- Severity: Unrated
- Published: Feb 26, 2018
- Affected: from 2.8.0, fixed in 2.8.11.1; from 2.9.0, fixed in 2.9.5; from 2.7.0, fixed in 2.7.9.3; fixed in 2.6.7.5.
- Fixed in 2.6.7.5 (released Jun 22, 2021, 1212 days after disclosure), 2.7.9.3 (released Feb 11, 2018, 15 days before disclosure), 2.8.11.1 (released Feb 11, 2018, 15 days before disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2017-7525](https://cve.now/CVE-2017-7525): A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica

- Severity: Unrated
- Published: Feb 6, 2018
- Affected: fixed in 2.6.7.1; from 2.7.0, fixed in 2.7.9.1; from 2.8.0, fixed in 2.8.9.
- Fixed in 2.6.7.1 (released Jul 11, 2017, 210 days before disclosure), 2.7.9.1 (released Apr 18, 2017, 294 days before disclosure) and 2.8.9 (released Jun 12, 2017, 239 days before disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2017-15095](https://cve.now/CVE-2017-15095): A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user

- Severity: Unrated
- Published: Feb 6, 2018
- Affected: from 2.8.0, fixed in 2.8.11; from 2.9.0, fixed in 2.9.4; from 2.0.0, fixed in 2.6.7.3; from 2.7.0, fixed in 2.7.9.2.
- Fixed in 2.6.7.3 (released Oct 16, 2019, 617 days after disclosure), 2.7.9.2 (released Dec 20, 2017, 48 days before disclosure), 2.8.11 (released Dec 24, 2017, 44 days before disclosure) and 1 other version.
- The latest release, 2.23.0, is not affected.

### [CVE-2018-5968](https://cve.now/CVE-2018-5968): FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix

- Severity: Unrated
- Published: Jan 22, 2018
- Affected: from 2.8.0, fixed in 2.8.11.1; from 2.9.0, fixed in 2.9.4; fixed in 2.7.9.5.
- Fixed in 2.7.9.5 (released Nov 23, 2018, 305 days after disclosure), 2.8.11.1 (released Feb 11, 2018, 20 days after disclosure) and 2.9.4 (released Jan 24, 2018, 2 days after disclosure).
- The latest release, 2.23.0, is not affected.

### [CVE-2017-17485](https://cve.now/CVE-2017-17485): FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete…

- Severity: Critical 9.8
- Published: Jan 10, 2018
- Affected: from 2.9.0, fixed in 2.9.4; from 2.8.0, fixed in 2.8.11; fixed in 2.7.9.2.
- Fixed in 2.7.9.2 (released Dec 20, 2017, 21 days before disclosure), 2.8.11 (released Dec 24, 2017, 17 days before disclosure) and 2.9.4 (released Jan 24, 2018, 14 days after disclosure).
- The latest release, 2.23.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/com.fasterxml.jackson.core:jackson-databind
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.