MEDIUM6.5Maven
GHSA-3pjw-73gf-8qr5· CVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Modified: 9/10/2026
package
Maven/tools.jackson.core:jackson-databind
pkg:maven/tools.jackson.core:jackson-databind
MEDIUM6.5Maven
GHSA-5gvw-p9qm-jgwh· CVE-2026-59889jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
Modified: 9/10/2026
MEDIUM5.3Maven
GHSA-5hh8-q8hv-fr38· CVE-2026-54517jackson-databind has @JsonView bypass for setterless creator properties
Modified: 9/10/2026
MEDIUM5.3Maven
GHSA-5jmj-h7xm-6q6v· CVE-2026-54515jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Modified: 9/10/2026
MEDIUM5.3Maven
GHSA-9fxm-vc8v-hj55· CVE-2026-54516jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
Modified: 9/10/2026
HIGH7.5Maven
GHSA-cxp5-3px4-pw24· CVE-2026-91777jackson-databind quadratic forward-reference completion
Modified: 9/30/2026
MEDIUM5.6Maven
GHSA-gx83-3vf8-gh7j· CVE-2026-83557jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
Modified: 9/28/2026
MEDIUM5.3Maven
GHSA-hgj6-7826-r7m5· CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
Modified: 9/10/2026
HIGH8.1Maven
GHSA-j3rv-43j4-c7qm· CVE-2026-54512jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
Modified: 9/10/2026
HIGH7.5Maven
GHSA-q4xh-88c3-wmh7· CVE-2026-68497jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS
Modified: 9/28/2026
MEDIUM6.5Maven
GHSA-rcqc-6cw3-h962· CVE-2026-54518jackson-databind has a @JsonView bypass for unwrapped creator parameters
Modified: 9/10/2026
HIGH8.1Maven
GHSA-rmj7-2vxq-3g9f· CVE-2026-54513jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Modified: 9/11/2026
MEDIUM5.3Maven
GHSA-vvgp-rfg2-7rr6· CVE-2026-77310jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization
Modified: 9/28/2026
MEDIUM5.3Maven
GHSA-wjgm-6hv5-3cvf· CVE-2026-19032jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
Modified: 9/28/2026
HIGH7.5Maven
GHSA-wv8q-qhhj-9h54· CVE-2026-91776jackson-databind retains every unknown raw type ID
Modified: 9/30/2026