Known vulnerabilities in jackson-databind
Vendor:
FasterXML
Software:
jackson-databind
Software CPE:
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
Website:
https://github.com/FasterXML
Total vulnerabilities:
83
Public exploits:
13
Known exploited (KEV):
0
Breakdown by Severity Chart
3.2.4
2.18.12
2.21.8
2.22.4
3.1.8
3.2.3
3.1.7
2.22.3
2.21.7
2.18.11
2.22.2
2.18.10
3.2.2
3.1.6
2.21.6
3.2.1
3.1.5
2.18.9
2.22.1
2.21.5
3.2.0
2.22.0
3.1.4
2.21.4
2.18.8
3.1.3
2.21.3
2.18.7
3.1.2
3.1.1
2.21.2
3.1.0
2.21.1
2.18.6
3.0.4
2.20.2
2.21.0
3.0.3
3.0.2
2.20.1
2.19.4
2.19.3
2.18.5
3.0.1
3.0.0
2.20.0
2.19.2
2.19.1
2.18.4
2.19.0
2.18.3
2.18.2
2.17.3
2.18.1
2.18.0
2.17.2
2.17.1
2.12.7.2
2.17.0
2.16.2
2.15.4
2.16.1
2.16.0
2.15.3
2.15.2
2.15.1
2.14.3
2.15.0
2.14.2
2.13.5
2.14.1
2.14.0
2.14.0-rc1
2.13.4.2
2.12.7.1
2.13.4.1
2.13.4
2.12.7
2.13.3
2.13.2.2
2.12.6.1
2.13.2.1
2.13.2
2.13.1
2.12.6
2.13.0
2.12.5
2.12.4
2.6.7.5
2.12.3
2.12.2
2.12.1
2.9.10.8
2.11.4
2.10.5.1
2.9.10.7
2.12.0
2.6.7.4
2.11.3
2.9.10.6
2.11.2
2.10.5
2.11.1
2.9.10.5
2.10.4
2.11.0
2.9.10.4
2.8.11.6
2.7.9.7
2.10.3
2.9.10.3
2.8.11.5
2.10.2
2.9.10.2
2.10.1
1.9.13
1.7.7
2.10.0
2.9.10.1
2.9.9.3
2.6.7.3
2.6.7.2
2.6.7.1
2.2.4
2.2.3
2.2.2
2.2.1
2.2.0
2.1.5
2.0.6
2.0.5
2.9.10
2.9.9.2
2.9.9.1
2.8.11.4
2.8.11.3
2.7.9.6
2.7.9.5
2.7.9.4
2.8.11.2
2.9.9
2.9.8
2.9.7
2.9.6
2.9.5
2.8.11.1
2.9.4
2.7.9.3
2.7.9.2
2.7.8
2.7.7
2.7.6
2.7.5
2.7.4
2.7.3
2.7.2
2.7.1
2.7.0
2.6.8
2.6.7
2.6.6
2.6.5
2.6.4
2.6.3
2.6.2
2.6.1
2.6.0
2.5.5
2.5.4
2.5.3
2.5.2
2.5.1
2.5.0
2.4.6.1
2.4.6
2.4.5.1
2.4.5
2.4.4
2.4.3
2.4.2
2.4.1.3
2.4.1.2
2.4.1.1
2.4.1
2.4.0
2.3.5
2.3.4
2.3.3
2.3.2
2.3.1
2.3.0
2.1.4
2.1.3
2.1.2
2.1.1
2.1.0
2.0.4
2.0.3
2.0.2
2.0.1
2.0.0
2.8.11
2.8.9
2.8.8.1
2.8.8
2.8.7
2.8.6
2.8.5
2.8.4
2.8.3
2.8.2
2.8.1
2.8.0
2.7.9.1
2.7.9
2.9.3
2.9.2
2.9.1
2.9.0
2.8.10
Vulnerabilities (83)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU151566 - Resource exhaustion CVE-2026-91777 |
CWE-400 | Medium | 2.18.11, 2.21.7, 2.22.3, 3.1.7, 3.2.3 | 22.09.2026 |
SB2026092225 SB2026101224 SB2026101332 and 12 more |
||
| #VU151565 - Resource exhaustion CVE-2026-91776 |
CWE-400 | Medium | 2.8.11, 2.21.7, 2.22.3, 3.1.7, 3.2.3 | 22.09.2026 |
SB2026092225 SB2026101224 SB2026101332 and 7 more |
||
| #VU146540 - Deserialization of Untrusted Data CVE-2026-83557 |
CWE-502 | Medium | 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2 | 01.09.2026 |
SB2026090116 SB2026092909 SB2026092956 and 14 more |
||
| #VU144596 - Server-Side Request Forgery (SSRF) CVE-2026-77310 |
CWE-918 | Medium | 2.18.9, 2.21.1, 2.21.5, 3.1.5, 3.2.1 | 24.08.2026 |
SB2026072278 SB2026090312 SB2026091103 and 5 more |
||
| #VU144594 - Resource exhaustion CVE-2026-68497 |
CWE-400 | Medium | 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2 | 24.08.2026 |
SB2026082435 SB2026092909 SB2026092956 and 13 more |
||
| #VU144593 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') CVE-2026-19032 |
CWE-470 | Medium | 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2 | 24.08.2026 |
SB2026082435 SB2026092909 SB2026092956 and 14 more |
||
| #VU144592 - Resource exhaustion CVE-2026-50193 |
CWE-400 | Medium | 2.14.0 | 24.08.2026 |
SB2026082434 SB2026083158 SB20261007203 and 1 more |
||
| #VU139159 - Deserialization of Untrusted Data CVE-2026-54512 |
CWE-502 | High | 2.18.8, 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072283 and 38 more |
||
| #VU139158 - Incomplete List of Disallowed Inputs CVE-2026-54513 |
CWE-184 | High | 2.18.8, 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072283 and 40 more |
||
| #VU139157 - Server-Side Request Forgery (SSRF) CVE-2026-54514 |
CWE-918 | Medium | 2.18.8, 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072288 SB2026072340 and 18 more |
||
| #VU139156 - Improperly Controlled Modification of Dynamically-Determined Object Attributes CVE-2026-54515 |
CWE-915 | Medium | 2.18.9, 2.21.5, 2.22.1, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072288 and 20 more |
||
| #VU139155 - Improperly Controlled Modification of Dynamically-Determined Object Attributes CVE-2026-54516 |
CWE-915 | Medium | 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072340 and 12 more |
||
| #VU139154 - Incorrect Authorization CVE-2026-54517 |
CWE-863 | Medium | 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072340 and 12 more |
||
| #VU139153 - Incorrect Authorization CVE-2026-54518 |
CWE-863 | Medium | 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072282 SB2026072340 and 10 more |
||
| #VU139152 - Improperly Controlled Modification of Dynamically-Determined Object Attributes CVE-2026-59888 |
CWE-915 | Medium | 2.18.8, 2.21.4, 3.1.4 | 22.07.2026 |
SB2026072278 SB2026072413 SB20260728138 and 13 more |
||
| #VU139151 - Incorrect Authorization CVE-2026-59889 |
CWE-863 | Low | 2.18.9, 2.21.5, 2.22.1, 3.1.5, 3.2.1 | 22.07.2026 |
SB2026072278 SB2026072413 SB20260728138 and 13 more |
||
| #VU139150 - Incorrect Authorization |
CWE-863 | Medium | 2.18.9, 2.20.0, 2.21.0, 2.21.5 | 22.07.2026 |
SB2026072278 |
||
| #VU68832 - Resource exhaustion CVE-2022-42004 |
CWE-400 | Medium | 2.13.4 | 31.10.2022 |
SB2022103116 SB2022103117 SB2022111404 and 122 more |
||
| #VU68635 - Deserialization of Untrusted Data CVE-2022-42003 |
CWE-502 | Medium | 2.12.7.1, 2.13.4.2, 2.14.0 rc1 | 25.10.2022 |
SB2022102509 SB2022102510 SB2022103117 and 208 more |
||
| #VU61799 - Out-of-bounds write CVE-2020-36518 |
CWE-787 | Medium | 2.12.6.1, 2.13.2.1 | 01.04.2022 |
SB2022040113 SB2022040114 SB2022040115 and 147 more |
Showing elements 1 - 20 out of 83