# cve.now: Fasterxml

The newest entries naming Fasterxml as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-106554](https://cve.now/CVE-2026-106554.md): jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC) (CVSS 7.5)
- [CVE-2026-110879](https://cve.now/CVE-2026-110879.md): jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation… (CVSS 9.8)
- [CVE-2026-110747](https://cve.now/CVE-2026-110747.md): jackson-dataformat-protobuf: integer overflow in ProtobufParser.\_readStringKey() allows OutOfMemoryError from an 8-byte payload (CVSS 7.5)
- [CVE-2026-104895](https://cve.now/CVE-2026-104895.md): jackson-dataformat-smile: unbounded eager byte\[\] allocation for raw binary in the async parser allows OutOfMemoryError denial of service (CVSS 7.5)
- [CVE-2026-104016](https://cve.now/CVE-2026-104016.md): jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError (CVSS 7.5)
- [CVE-2026-68498](https://cve.now/CVE-2026-68498.md): jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service (CVSS 7.5)
- [CVE-2026-68496](https://cve.now/CVE-2026-68496.md): jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service (CVSS 7.5)
- [CVE-2026-68495](https://cve.now/CVE-2026-68495.md): jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service (CVSS 7.5)
- [CVE-2026-91777](https://cve.now/CVE-2026-91777.md): jackson-databind: quadratic forward-reference completion in Collection and Map deserializers (CVSS 7.5)
- [CVE-2026-91776](https://cve.now/CVE-2026-91776.md): jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID (CVSS 7.5)
- [CVE-2026-89425](https://cve.now/CVE-2026-89425.md): jackson-core: UTF8DataInputJsonParser.\_reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth (CVSS 7.5)
- [CVE-2026-89407](https://cve.now/CVE-2026-89407.md): jackson-core: quadratic backtracking in NumberInput.PATTERN\_FLOAT via looksLikeValidNumber() enables ReDoS (CVSS 7.5)
- [CVE-2026-68497](https://cve.now/CVE-2026-68497.md): jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service (CVSS 7.5)
- [CVE-2026-83557](https://cve.now/CVE-2026-83557.md): jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types (CVSS 5.6)
- [CVE-2026-19032](https://cve.now/CVE-2026-19032.md): jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path (CVSS 5.3)
- [CVE-2026-77310](https://cve.now/CVE-2026-77310.md): jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) (CVSS 5.3)
- [CVE-2026-68494](https://cve.now/CVE-2026-68494.md): jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) (CVSS 8.7)
- [CVE-2026-18401](https://cve.now/CVE-2026-18401.md): jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service (CVSS 6.9)
- [CVE-2026-59889](https://cve.now/CVE-2026-59889.md): jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization (CVSS 6.5)
- [CVE-2026-59888](https://cve.now/CVE-2026-59888.md): jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy (CVSS 6.5)
- [CVE-2026-54518](https://cve.now/CVE-2026-54518.md): jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind (CVSS 6.5)
- [CVE-2026-50193](https://cve.now/CVE-2026-50193.md): jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() (CVSS 6.3)
- [CVE-2026-54512](https://cve.now/CVE-2026-54512.md): jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation (CVSS 8.1)
- [CVE-2026-54513](https://cve.now/CVE-2026-54513.md): jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) (CVSS 8.1)
- [CVE-2026-54514](https://cve.now/CVE-2026-54514.md): jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) (CVSS 5.3)
- [CVE-2026-54515](https://cve.now/CVE-2026-54515.md): jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties (CVSS 5.3)
- [CVE-2026-54516](https://cve.now/CVE-2026-54516.md): jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields (CVSS 5.3)
- [CVE-2026-54517](https://cve.now/CVE-2026-54517.md): jackson-databind: @JsonView bypass for setterless creator properties (CVSS 5.3)
- [CVE-2026-29062](https://cve.now/CVE-2026-29062.md): jackson-core: Nesting Depth Constraint Bypass in \`UTF8DataInputJsonParser\` potentially allowing Resource Exhaustion (CVSS 8.7)
- [CVE-2025-52999](https://cve.now/CVE-2025-52999.md): jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data (CVSS 8.7)
- [CVE-2025-49128](https://cve.now/CVE-2025-49128.md): Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation (CVSS 4.0)
- [CVE-2023-3894](https://cve.now/CVE-2023-3894.md): DOS in jackson-dataformats-text (CVSS 5.8)
- [CVE-2017-7525](https://cve.now/CVE-2017-7525.md): A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica (no CVSS)
- [CVE-2017-15095](https://cve.now/CVE-2017-15095.md): A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/fasterxml
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.