Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.fasterxml.jackson.dataformat:jackson-dataformat-smile

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

Latest release
2.22.4 (Oct 17, 2026): no advisory affects it
Newest unaffected release
2.22.4 (Oct 17, 2026), the latest release
Advisories
1 · 1 high
Dependents
99
Releases
196 since 2.0.0 (Mar 25, 2012)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-104895
    Affects 2.9.0 to 2.18.11 (2.18.12 is outside it); 2.19.0 to 2.21.7 (2.21.8 is outside it); 2.22.0 to 2.22.3 (2.22.4 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

  • jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

    Affected: from 2.9.0, fixed in 2.18.12; from 2.19.0, fixed in 2.21.8; from 2.22.0, fixed in 2.22.4.

    Fixed in 2.18.12 (released Oct 18, 2026, 10 days before disclosure), 2.21.8 (released Oct 18, 2026, 10 days before disclosure) and 2.22.4 (released Oct 17, 2026, 11 days before disclosure).

    The latest release, 2.22.4, is not affected.