MavenPackage

tools.jackson.core:jackson-databind

16 known vulnerabilities (1 critical, 5 high, 10 medium), with the versions each affects and the releases that fix them.

Latest release: 3.2.4 (Oct 18, 2026): no advisory affects it
Newest unaffected release: 3.2.4 (Oct 18, 2026), the latest release
Advisories: 16 · 1 critical, 5 high, 10 medium

Dependents: 1,404
Releases: 30 since 3.0.0 (Oct 3, 2025)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-110879
Affects 3.0.0 to 3.1.7 (3.1.8 is outside it); 3.2.0 to 3.2.3 (3.2.4 is outside it)
CVE-2026-91777
Affects 3.0.0 to 3.1.6 (3.1.7 is outside it); 3.2.0 to 3.2.2 (3.2.3 is outside it)
CVE-2026-91776
Affects 3.0.0 to 3.1.6 (3.1.7 is outside it); 3.2.0 to 3.2.2 (3.2.3 is outside it)
CVE-2026-68497
Affects 3.0.0 to 3.1.5 (3.1.6 is outside it); 3.2.0 to 3.2.1 (3.2.2 is outside it)
CVE-2026-83557
Affects 3.0.0 to 3.1.5 (3.1.6 is outside it); 3.2.0 to 3.2.1 (3.2.2 is outside it)
CVE-2026-19032
Affects 3.0.0 to 3.1.5 (3.1.6 is outside it); 3.2.0 to 3.2.1 (3.2.2 is outside it)
CVE-2026-77310
Affects 3.0.0 to 3.1.4 (3.1.5 is outside it); 3.2.0 (3.2.1 is outside it)
CVE-2026-59889
Affects 3.0.0 to 3.1.4 (3.1.5 is outside it); 3.2.0 (3.2.1 is outside it)
CVE-2026-59888
Affects 3.0.0 to 3.1.3 (3.1.4 is outside it)
CVE-2026-54518
Affects 3.0.0 to 3.1.3 (3.1.4 is outside it)
CVE-2026-54512
Affects 3.0.0 to 3.1.3 (3.1.4 is outside it)
CVE-2026-54513
Affects 3.0.0 to 3.1.3 (3.1.4 is outside it)

Show all 16 advisoriesShow fewer advisories

CVE-2026-54514
Affects 3.0.0 to 3.1.3 (3.1.4 is outside it)
CVE-2026-54515
Affects 3.1.0 to 3.1.3 (3.1.4 is outside it)
CVE-2026-54516
Affects 3.0.0 to 3.1.3 (3.1.4 is outside it)
CVE-2026-54517
Affects 3.0.0 to 3.1.3 (3.1.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 16

CVE-2026-110879Critical 9.8
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation…
Affected: from 3.0.0, fixed in 3.1.8; from 3.2.0, fixed in 3.2.4.
Fixed in 3.1.8 (released Oct 18, 2026, 10 days before disclosure) and 3.2.4 (released Oct 18, 2026, 10 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-91777High 7.5
jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
Affected: from 3.0.0, through 3.1.6; from 3.2.0, through 3.2.2; from 3.0.0, fixed in 3.1.7; from 3.2.0, fixed in 3.2.3.
Fixed in 3.1.7 (released Sep 22, 2026, 1 day before disclosure) and 3.2.3 (released Sep 22, 2026, 1 day before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-91776High 7.5
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
Affected: from 3.0.0, through 3.1.6; from 3.2.0, through 3.2.2; from 3.0.0, fixed in 3.1.7; from 3.2.0, fixed in 3.2.3.
Fixed in 3.1.7 (released Sep 22, 2026, 1 day before disclosure) and 3.2.3 (released Sep 22, 2026, 1 day before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-68497High 7.5
jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
Affected: from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2; from 3.2.0, fixed in 3.2.2; from 3.0.0, fixed in 3.1.6.
Fixed in 3.1.6 (released Aug 14, 2026, 28 days before disclosure) and 3.2.2 (released Aug 14, 2026, 28 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-83557Medium 5.6
jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
Affected: from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2; from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2.
Fixed in 3.1.6 (released Aug 14, 2026, 18 days before disclosure) and 3.2.2 (released Aug 14, 2026, 18 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-19032Medium 5.3
jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
Affected: from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2; from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2.
Fixed in 3.1.6 (released Aug 14, 2026, 18 days before disclosure) and 3.2.2 (released Aug 14, 2026, 18 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-77310Medium 5.3
jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
Affected: from 3.0.0, fixed in 3.1.5; from 3.2.0, fixed in 3.2.1.
Fixed in 3.1.5 (released Jul 8, 2026, 47 days before disclosure) and 3.2.1 (released Jul 10, 2026, 45 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-59889Medium 6.5
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
Affected: from 3.0.0, fixed in 3.1.5; from 3.2.0, fixed in 3.2.1.
Fixed in 3.1.5 (released Jul 8, 2026, 6 days before disclosure) and 3.2.1 (released Jul 10, 2026, 4 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-59888Medium 6.5
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Affected: from 3.0.0, fixed in 3.1.4.
Fixed in 3.1.4 (released May 29, 2026, 46 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-54518Medium 6.5
jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind
Affected: from 3.0.0, fixed in 3.1.4.
Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-54512High 8.1
jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
Affected: from 3.0.0, fixed in 3.1.4.
Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-54513High 8.1
jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Affected: from 3.0.0, fixed in 3.1.4.
Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-54514Medium 5.3
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
Affected: from 2.19.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4.
Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure, the advisory names 2.21.4, which was never published).
The latest release, 3.2.4, is not affected.
CVE-2026-54515Medium 5.3
jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Affected: from 3.1.0, fixed in 3.1.4.
Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-54516Medium 5.3
jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields
Affected: from 3.0.0, fixed in 3.1.4.
Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 3.2.4, is not affected.
CVE-2026-54517Medium 5.3
jackson-databind: @JsonView bypass for setterless creator properties
Affected: from 3.0.0, fixed in 3.1.4.
Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure).
The latest release, 3.2.4, is not affected.