FFasterXML

Products

Exploited and recent CVEs

• CVE-2026-106554 Unrated jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC) 0.2%
• CVE-2026-110879 Critical 9.8 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) 1.2%
• CVE-2026-110747 High 7.5 jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload 0.4%
• CVE-2026-104895 High 7.5 jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service 0.4%
• CVE-2026-104016 High 7.5 jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError 0.7%
• CVE-2026-68498 High 7.5 jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service 0.7%
• CVE-2026-68496 High 7.5 jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service 0.6%
• CVE-2026-68495 High 7.5 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service 0.6%
• CVE-2026-91777 High 7.5 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers 0.5%
• CVE-2026-91776 High 7.5 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID 0.5%
• CVE-2026-89425 High 7.5 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth 0.5%
• CVE-2026-89407 High 7.5 jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS 0.6%
• CVE-2026-68497 High 7.5 jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service 0.6%
• CVE-2026-83557 Medium 5.6 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types 0.7%
• CVE-2026-19032 Medium 5.3 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path 0.6%
• CVE-2026-77310 Medium 5.3 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) 0.3%
• CVE-2026-77310 Medium 5.3 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) 0.3%
• CVE-2026-68494 High 8.7 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) 0.5%
• CVE-2026-18401 Medium 6.9 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service 0.4%
• CVE-2026-59889 Medium 6.5 jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization 0.3%
• CVE-2026-59888 Medium 6.5 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy 0.4%
• CVE-2026-54518 Medium 6.5 jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind 0.4%
• CVE-2026-50193 Medium 6.3 jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() 0.6%
• CVE-2026-54512 High 8.1 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation 1.1%
• CVE-2026-54513 High 8.1 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) 1.2%
• CVE-2026-54514 Medium 5.3 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) 0.4%
• CVE-2026-54515 Medium 5.3 jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties 0.4%
• CVE-2026-54516 Medium 5.3 jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields 0.4%
• CVE-2026-54517 Medium 5.3 jackson-databind: @JsonView bypass for setterless creator properties 0.4%
• CVE-2026-29062 High 7.5 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion 0.6%