# tools.jackson.core:jackson-databind (Maven) vulnerabilities 16 known vulnerabilities (1 critical, 5 high, 10 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.2.4 (Oct 18, 2026): no advisory affects it - Newest unaffected release: 3.2.4 (Oct 18, 2026), the latest release - Dependents: 1,404 - Releases: 30 since 3.0.0 (Oct 3, 2025) - Registry: https://central.sonatype.com/artifact/tools.jackson.core/jackson-databind - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-110879: 3.0.0 to 3.1.7 (3.1.8 is outside it); 3.2.0 to 3.2.3 (3.2.4 is outside it) - CVE-2026-91777: 3.0.0 to 3.1.6 (3.1.7 is outside it); 3.2.0 to 3.2.2 (3.2.3 is outside it) - CVE-2026-91776: 3.0.0 to 3.1.6 (3.1.7 is outside it); 3.2.0 to 3.2.2 (3.2.3 is outside it) - CVE-2026-68497: 3.0.0 to 3.1.5 (3.1.6 is outside it); 3.2.0 to 3.2.1 (3.2.2 is outside it) - CVE-2026-83557: 3.0.0 to 3.1.5 (3.1.6 is outside it); 3.2.0 to 3.2.1 (3.2.2 is outside it) - CVE-2026-19032: 3.0.0 to 3.1.5 (3.1.6 is outside it); 3.2.0 to 3.2.1 (3.2.2 is outside it) - CVE-2026-77310: 3.0.0 to 3.1.4 (3.1.5 is outside it); 3.2.0 (3.2.1 is outside it) - CVE-2026-59889: 3.0.0 to 3.1.4 (3.1.5 is outside it); 3.2.0 (3.2.1 is outside it) - CVE-2026-59888: 3.0.0 to 3.1.3 (3.1.4 is outside it) - CVE-2026-54518: 3.0.0 to 3.1.3 (3.1.4 is outside it) - CVE-2026-54512: 3.0.0 to 3.1.3 (3.1.4 is outside it) - CVE-2026-54513: 3.0.0 to 3.1.3 (3.1.4 is outside it) - CVE-2026-54514: 3.0.0 to 3.1.3 (3.1.4 is outside it) - CVE-2026-54515: 3.1.0 to 3.1.3 (3.1.4 is outside it) - CVE-2026-54516: 3.0.0 to 3.1.3 (3.1.4 is outside it) - CVE-2026-54517: 3.0.0 to 3.1.3 (3.1.4 is outside it) ## Advisories (16) ### [CVE-2026-110879](https://cve.now/CVE-2026-110879): jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation… - Severity: Critical 9.8 - Published: Oct 28, 2026 - Affected: from 3.0.0, fixed in 3.1.8; from 3.2.0, fixed in 3.2.4. - Fixed in 3.1.8 (released Oct 18, 2026, 10 days before disclosure) and 3.2.4 (released Oct 18, 2026, 10 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-91777](https://cve.now/CVE-2026-91777): jackson-databind: quadratic forward-reference completion in Collection and Map deserializers - Severity: High 7.5 - Published: Sep 23, 2026 - Affected: from 3.0.0, through 3.1.6; from 3.2.0, through 3.2.2; from 3.0.0, fixed in 3.1.7; from 3.2.0, fixed in 3.2.3. - Fixed in 3.1.7 (released Sep 22, 2026, 1 day before disclosure) and 3.2.3 (released Sep 22, 2026, 1 day before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-91776](https://cve.now/CVE-2026-91776): jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID - Severity: High 7.5 - Published: Sep 23, 2026 - Affected: from 3.0.0, through 3.1.6; from 3.2.0, through 3.2.2; from 3.0.0, fixed in 3.1.7; from 3.2.0, fixed in 3.2.3. - Fixed in 3.1.7 (released Sep 22, 2026, 1 day before disclosure) and 3.2.3 (released Sep 22, 2026, 1 day before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-68497](https://cve.now/CVE-2026-68497): jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service - Severity: High 7.5 - Published: Sep 11, 2026 - Affected: from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2; from 3.2.0, fixed in 3.2.2; from 3.0.0, fixed in 3.1.6. - Fixed in 3.1.6 (released Aug 14, 2026, 28 days before disclosure) and 3.2.2 (released Aug 14, 2026, 28 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-83557](https://cve.now/CVE-2026-83557): jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types - Severity: Medium 5.6 - Published: Sep 1, 2026 - Affected: from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2; from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2. - Fixed in 3.1.6 (released Aug 14, 2026, 18 days before disclosure) and 3.2.2 (released Aug 14, 2026, 18 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-19032](https://cve.now/CVE-2026-19032): jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path - Severity: Medium 5.3 - Published: Sep 1, 2026 - Affected: from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2; from 3.0.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.2. - Fixed in 3.1.6 (released Aug 14, 2026, 18 days before disclosure) and 3.2.2 (released Aug 14, 2026, 18 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-77310](https://cve.now/CVE-2026-77310): jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) - Severity: Medium 5.3 - Published: Aug 24, 2026 - Affected: from 3.0.0, fixed in 3.1.5; from 3.2.0, fixed in 3.2.1. - Fixed in 3.1.5 (released Jul 8, 2026, 47 days before disclosure) and 3.2.1 (released Jul 10, 2026, 45 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-59889](https://cve.now/CVE-2026-59889): jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization - Severity: Medium 6.5 - Published: Jul 14, 2026 - Affected: from 3.0.0, fixed in 3.1.5; from 3.2.0, fixed in 3.2.1. - Fixed in 3.1.5 (released Jul 8, 2026, 6 days before disclosure) and 3.2.1 (released Jul 10, 2026, 4 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-59888](https://cve.now/CVE-2026-59888): jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy - Severity: Medium 6.5 - Published: Jul 14, 2026 - Affected: from 3.0.0, fixed in 3.1.4. - Fixed in 3.1.4 (released May 29, 2026, 46 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-54518](https://cve.now/CVE-2026-54518): jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind - Severity: Medium 6.5 - Published: Jun 23, 2026 - Affected: from 3.0.0, fixed in 3.1.4. - Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-54512](https://cve.now/CVE-2026-54512): jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation - Severity: High 8.1 - Published: Jun 23, 2026 - Affected: from 3.0.0, fixed in 3.1.4. - Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-54513](https://cve.now/CVE-2026-54513): jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) - Severity: High 8.1 - Published: Jun 23, 2026 - Affected: from 3.0.0, fixed in 3.1.4. - Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-54514](https://cve.now/CVE-2026-54514): jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) - Severity: Medium 5.3 - Published: Jun 23, 2026 - Affected: from 2.19.0, fixed in 2.21.4; from 3.0.0, fixed in 3.1.4. - Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure, the advisory names 2.21.4, which was never published). - The latest release, 3.2.4, is not affected. ### [CVE-2026-54515](https://cve.now/CVE-2026-54515): jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties - Severity: Medium 5.3 - Published: Jun 23, 2026 - Affected: from 3.1.0, fixed in 3.1.4. - Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-54516](https://cve.now/CVE-2026-54516): jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields - Severity: Medium 5.3 - Published: Jun 23, 2026 - Affected: from 3.0.0, fixed in 3.1.4. - Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure). - The latest release, 3.2.4, is not affected. ### [CVE-2026-54517](https://cve.now/CVE-2026-54517): jackson-databind: @JsonView bypass for setterless creator properties - Severity: Medium 5.3 - Published: Jun 23, 2026 - Affected: from 3.0.0, fixed in 3.1.4. - Fixed in 3.1.4 (released May 29, 2026, 25 days before disclosure). - The latest release, 3.2.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/tools.jackson.core:jackson-databind Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.