CVE-2026-110879Critical 9.8jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)1.2%
CVE-2026-91777High 7.5jackson-databind: quadratic forward-reference completion in Collection and Map deserializers0.5%
CVE-2026-91776High 7.5jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID0.5%
CVE-2026-68497High 7.5jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service0.6%
CVE-2026-83557Medium 5.6jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types0.7%
CVE-2026-19032Medium 5.3jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path0.6%
CVE-2026-59889Medium 6.5jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization0.3%
CVE-2026-59888Medium 6.5jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy0.4%
CVE-2026-54518Medium 6.5jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind0.4%
CVE-2026-50193Medium 6.3jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()0.6%
CVE-2026-54512High 8.1jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation1.1%
CVE-2026-54513High 8.1jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)1.2%
CVE-2026-54514Medium 5.3jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)0.4%