[ Vendor · 15 CVEs ]
FasterXML
CVEs affecting FasterXML published in the last 30 days, plus any FasterXML CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-68498 | 16 Oct 2026 | CVSS 7.5 | FasterXML jackson-coreStreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume… | |
| CVE-2026-68495 | 1 Oct 2026 | CVSS 7.5 | FasterXML jackson-dataformats-binaryThe CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property… | |
| CVE-2026-68496 | 1 Oct 2026 | CVSS 7.5 | FasterXML jackson-dataformats-binaryThe Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property… | |
| CVE-2026-89425 | 23 Sep 2026 | CVSS 7.5 | jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java… | Fix |
| CVE-2026-91776 | 23 Sep 2026 | CVSS 7.5 | jackson-databind retains every unknown raw type IDTypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID… | Fix |
| CVE-2026-91777 | 23 Sep 2026 | CVSS 7.5 | jackson-databind quadratic forward-reference completionForward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference… | Fix |
| CVE-2026-89407 | 22 Sep 2026 | CVSS 7.5 | jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT… | Fix |
| CVE-2026-68497 | 11 Sep 2026 | CVSS 7.5 | jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSjackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string… | Fix |
| CVE-2026-83557 | 1 Sep 2026 | CVSS 5.6 | jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly… | Fix |
| CVE-2026-19032 | 1 Sep 2026 | CVSS 5.3 | jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolutionjackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In… | Fix |
| CVE-2026-77310 | 24 Aug 2026 | CVSS 5.3 | jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5… | Fix |
| CVE-2026-59889 | 14 Jul 2026 | CVSS 6.5 | FasterXML jackson-databindjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5… | |
| CVE-2026-54512 | 23 Jun 2026 | CVSS 8.1 | FasterXML jackson-databindjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4… | |
| CVE-2026-54513 | 23 Jun 2026 | CVSS 8.1 | FasterXML jackson-databindjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4… | |
| CVE-2026-54515 | 23 Jun 2026 | CVSS 5.3 | FasterXML jackson-databindjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5… |