Known vulnerabilities in jackson-databind
Vendor:
FasterXML
Software:
jackson-databind
Software CPE:
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
Website:
https://github.com/FasterXML
Total vulnerabilities:
82
Public exploits:
13
Known exploited (KEV):
0
Highest CVSSv4 Score:
9.3
Breakdown by Severity Chart
3.2.3
3.1.7
2.22.3
2.21.7
2.18.11
2.22.2
2.18.10
3.2.2
3.1.6
2.21.6
3.2.1
3.1.5
2.18.9
2.22.1
2.21.5
3.2.0
2.22.0
3.1.4
2.21.4
2.18.8
3.1.3
2.21.3
2.18.7
3.1.2
3.1.1
2.21.2
3.1.0
2.21.1
2.18.6
3.0.4
2.20.2
2.21.0
3.0.3
3.0.2
2.20.1
2.19.4
2.19.3
2.18.5
3.0.1
3.0.0
2.20.0
2.19.2
2.19.1
2.18.4
2.19.0
2.18.3
2.18.2
2.17.3
2.18.1
2.18.0
2.17.2
2.17.1
2.12.7.2
2.17.0
2.16.2
2.15.4
2.16.1
2.16.0
2.15.3
2.15.2
2.15.1
2.14.3
2.15.0
2.14.2
2.13.5
2.14.1
2.14.0
2.14.0-rc1
2.13.4.2
2.12.7.1
2.13.4.1
2.13.4
2.12.7
2.13.3
2.13.2.2
2.12.6.1
2.13.2.1
2.13.2
2.13.1
2.12.6
2.13.0
2.12.5
2.12.4
2.6.7.5
2.12.3
2.12.2
2.12.1
2.9.10.8
2.11.4
2.10.5.1
2.9.10.7
2.12.0
2.6.7.4
2.11.3
2.9.10.6
2.11.2
2.10.5
2.11.1
2.9.10.5
2.10.4
2.11.0
2.9.10.4
2.8.11.6
2.7.9.7
2.10.3
2.9.10.3
2.8.11.5
2.10.2
2.9.10.2
2.10.1
1.9.13
1.7.7
2.10.0
2.9.10.1
2.9.9.3
2.6.7.3
2.6.7.2
2.6.7.1
2.2.4
2.2.3
2.2.2
2.2.1
2.2.0
2.1.5
2.0.6
2.0.5
2.9.10
2.9.9.2
2.9.9.1
2.8.11.4
2.8.11.3
2.7.9.6
2.7.9.5
2.7.9.4
2.8.11.2
2.9.9
2.9.8
2.9.7
2.9.6
2.9.5
2.8.11.1
2.9.4
2.7.9.3
2.7.9.2
2.7.8
2.7.7
2.7.6
2.7.5
2.7.4
2.7.3
2.7.2
2.7.1
2.7.0
2.6.8
2.6.7
2.6.6
2.6.5
2.6.4
2.6.3
2.6.2
2.6.1
2.6.0
2.5.5
2.5.4
2.5.3
2.5.2
2.5.1
2.5.0
2.4.6.1
2.4.6
2.4.5.1
2.4.5
2.4.4
2.4.3
2.4.2
2.4.1.3
2.4.1.2
2.4.1.1
2.4.1
2.4.0
2.3.5
2.3.4
2.3.3
2.3.2
2.3.1
2.3.0
2.1.4
2.1.3
2.1.2
2.1.1
2.1.0
2.0.4
2.0.3
2.0.2
2.0.1
2.0.0
2.8.11
2.8.9
2.8.8.1
2.8.8
2.8.7
2.8.6
2.8.5
2.8.4
2.8.3
2.8.2
2.8.1
2.8.0
2.7.9.1
2.7.9
2.9.3
2.9.2
2.9.1
2.9.0
2.8.10
Vulnerabilities (82)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU151566 - Resource exhaustion CVE-2026-91777 |
CWE-400 | Medium | 2.18.11, 2.21.7, 2.22.3, 3.1.7, 3.2.3 | 22.09.2026 |
SB2026092225 |
||
| #VU151565 - Resource exhaustion CVE-2026-91776 |
CWE-400 | Medium | 2.8.11, 2.21.7, 2.22.3, 3.1.7, 3.2.3 | 22.09.2026 |
SB2026092225 |
||
| #VU146540 - Deserialization of Untrusted Data CVE-2026-83557 |
CWE-502 | Medium | 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2 | 01.09.2026 |
SB2026090116 SB2026092909 SB2026092956 and 1 more |
||
| #VU144596 - Server-Side Request Forgery (SSRF) CVE-2026-77310 |
CWE-918 | Medium | 2.18.9, 2.21.1, 2.21.5, 3.1.5, 3.2.1 | 24.08.2026 |
SB2026072278 SB2026090312 SB2026091103 and 1 more |
||
| #VU144594 - Resource exhaustion CVE-2026-68497 |
CWE-400 | Medium | 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2 | 24.08.2026 |
SB2026082435 SB2026092909 SB2026092956 |
||
| #VU144593 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') CVE-2026-19032 |
CWE-470 | Medium | 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2 | 24.08.2026 |
SB2026082435 SB2026092909 SB2026092956 and 1 more |
||
| #VU144592 - Resource exhaustion CVE-2026-50193 |
CWE-400 | Medium | 2.14.0 | 24.08.2026 |
SB2026082434 SB2026083158 |
||
| #VU139159 - Deserialization of Untrusted Data CVE-2026-54512 |
CWE-502 | High | 2.18.8, 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072283 and 33 more |
||
| #VU139158 - Incomplete List of Disallowed Inputs CVE-2026-54513 |
CWE-184 | High | 2.18.8, 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072283 and 35 more |
||
| #VU139157 - Server-Side Request Forgery (SSRF) CVE-2026-54514 |
CWE-918 | Medium | 2.18.8, 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072288 SB2026072340 and 14 more |
||
| #VU139156 - Improperly Controlled Modification of Dynamically-Determined Object Attributes CVE-2026-54515 |
CWE-915 | Medium | 2.18.9, 2.21.5, 2.22.1, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072288 and 16 more |
||
| #VU139155 - Improperly Controlled Modification of Dynamically-Determined Object Attributes CVE-2026-54516 |
CWE-915 | Medium | 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072340 and 9 more |
||
| #VU139154 - Incorrect Authorization CVE-2026-54517 |
CWE-863 | Medium | 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072340 and 9 more |
||
| #VU139153 - Incorrect Authorization CVE-2026-54518 |
CWE-863 | Medium | 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072340 and 9 more |
||
| #VU139152 - Improperly Controlled Modification of Dynamically-Determined Object Attributes CVE-2026-59888 |
CWE-915 | Medium | 2.18.8, 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072413 SB20260728138 and 8 more |
||
| #VU139151 - Incorrect Authorization CVE-2026-59889 |
CWE-863 | Low | 2.18.9, 2.21.5, 2.22.1, 3.1.5, 3.2.1 | 22.07.2026 |
SB2026072278 SB2026072413 SB20260728138 and 8 more |
||
| #VU139150 - Incorrect Authorization |
CWE-863 | Medium | 2.18.9, 2.20.0, 2.21.0, 2.21.5 | 22.07.2026 |
SB2026072278 |
||
| #VU68832 - Resource exhaustion CVE-2022-42004 |
CWE-400 | Medium | 2.13.4 | 31.10.2022 |
SB2022103116 SB2022103117 SB2022111404 and 122 more |
||
| #VU68635 - Deserialization of Untrusted Data CVE-2022-42003 |
CWE-502 | Medium | 2.12.7.1, 2.13.4.2, 2.14.0 rc1 | 25.10.2022 |
SB2022102509 SB2022102510 SB2022103117 and 208 more |
||
| #VU61799 - Out-of-bounds write CVE-2020-36518 |
CWE-787 | Medium | 2.12.6.1, 2.13.2.1 | 01.04.2022 |
SB2022040113 SB2022040114 SB2022040115 and 147 more |
Showing elements 1 - 20 out of 82