Fasterxml vulnerabilities
34 CVEs and advisories name Fasterxml as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-106554jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)
- CVE-2026-110879jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation…
- CVE-2026-110747jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
- CVE-2026-104895jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
- CVE-2026-104016jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError
- CVE-2026-68498jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service
- CVE-2026-68496jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
- CVE-2026-68495jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
- CVE-2026-91777jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
- CVE-2026-91776jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
- CVE-2026-89425jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth
- CVE-2026-89407jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
- CVE-2026-68497jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
- CVE-2026-83557jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
- CVE-2026-19032jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
- CVE-2026-77310jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
- CVE-2026-68494jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
- CVE-2026-18401jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service
- CVE-2026-59889jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
- CVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
- CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind
- CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
- CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
- CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
- CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
- CVE-2026-54516jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields
- CVE-2026-54517jackson-databind: @JsonView bypass for setterless creator properties
- CVE-2026-29062jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
- CVE-2025-52999jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data