RHLW-2026-DD1828F1F23F1AE5 Lightwell Security Advisory: jackson-databind 2.11.3.rhlw-00004

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.11.3.rhlw-00004 with backported fixes for CVE-2020-36518, CVE-2022-42004, and CVE-2021-46877. CVE-2020-36518: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth o...

GHSA-MHM7-754M-9P8W jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`

Summary In BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId, the active-view @JsonView filter was applied only to the regular bean-property branch; the creator-property branch performed no creatorProp.visibleInViewactiveView check. A constructor parameter annotated with both...

CVE-2026-54517: Incorrect Authorization

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer.deserializeUsingPropertyBased, the active-view @JsonView filter was applied only to creator properties; the regular...

jackson-dataformats-text:DeserializerFuzzer: Security exception in com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize

Project: https://github.com/FasterXML/jackson-dataformats-text.git Detailed Report: https://oss-fuzz.com/testcase?key=6249257906798592 Project: jackson-dataformats-text Fuzzing Engine: libFuzzer Fuzz Target: DeserializerFuzzer Job Type: libfuzzerasanjackson-dataformats-text Platform Id: linux Cra...

jackson-dataformat-xml:XmlDeserializerFuzzer: Security exception in com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize

Project: https://github.com/FasterXML/jackson-dataformat-xml.git Detailed Report: https://oss-fuzz.com/testcase?key=4668690686083072 Project: jackson-dataformat-xml Fuzzing Engine: libFuzzer Fuzz Target: XmlDeserializerFuzzer Job Type: libfuzzerasanjackson-dataformat-xml Platform Id: linux Crash...

jackson-dataformats-binary:DeserializerFuzzer: Security exception in com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize

Detailed Report: https://oss-fuzz.com/testcase?key=6008948677738496 Project: jackson-dataformats-binary Fuzzing Engine: libFuzzer Fuzz Target: DeserializerFuzzer Job Type: libfuzzerasanjackson-dataformats-binary Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Security Bulletin: Vulnerability in jackson-databind affects watsonx.data

Summary FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception and other causes Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception. By...

jackson-dataformats-text:DeserializerFuzzer: Security exception in com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize

Detailed Report: https://oss-fuzz.com/testcase?key=5141355676893184 Project: jackson-dataformats-text Fuzzing Engine: libFuzzer Fuzz Target: DeserializerFuzzer Job Type: libfuzzerasanjackson-dataformats-text Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

jackson-dataformat-xml:XmlDeserializerFuzzer: Security exception in com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize

Project: https://github.com/FasterXML/jackson-dataformat-xml.git Detailed Report: https://oss-fuzz.com/testcase?key=5386460851142656 Project: jackson-dataformat-xml Fuzzing Engine: libFuzzer Fuzz Target: XmlDeserializerFuzzer Job Type: libfuzzerasanjackson-dataformat-xml Platform Id: linux Crash...

jackson-dataformats-binary:DeserializerFuzzer: Security exception in com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize

Project: https://github.com/FasterXML/jackson-dataformats-binary.git Detailed Report: https://oss-fuzz.com/testcase?key=5891824744792064 Project: jackson-dataformats-binary Fuzzing Engine: libFuzzer Fuzz Target: DeserializerFuzzer Job Type: libfuzzerasanjackson-dataformats-binary Platform Id: lin...

FasterXML Vulnerability in Bamboo Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 9.1.0, 9.2.1, and 9.3.0 of Bamboo Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

F5 Networks BIG-IP : FasterXML vulnerability (K000132725)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000132725 advisory. - In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to [CVE-2022-42003] and [CVE-2022-42004]

Summary Jackson is used by IBM App Connect Enterprise Certified Container for processing XML configuration and data. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in...

jackson-databind: use of deeply nested arrays

A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer.deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices...

jackson-databind: use of deeply nested arrays

A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer.deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices...

GLSA-202210-21 : FasterXML jackson-databind: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-21 FasterXML jackson-databind: Multiple vulnerabilities - In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper...

Uncontrolled Resource Consumption in FasterXML jackson-databind

In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. This issue can only happen when the UNWRAPSINGLEVALUEARRAYS feature is explicitly...

CVE-2022-42004

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...

CVE-2022-42004

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...

CVE-2022-42004

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...