CVE-2022-23884

CVE-2022-23884 Minecraft: Bedrock Edition（別名Bedrock Server）の公式サーバーにはネットワーク層の脆弱性が存在し、攻撃者がDoS攻撃を仕掛けることを可能にします。 CVE-2022-23884 は、Mojang Bedrock Dedicated Server 1.16.0-1.18.12 に影響を与えます。これは、PurchaseReceiptPacket::read（パケットデシリアライザー）によって引き起こされる大きなループとサーバークラッシュです。 詳細 CVE-2022-23884 は Bedrock Server...

react-rsc-cve-2025-55182-lab

CVE-2025-55182 ラボ — React Server Components RCE 教育用ラボ: CVE-2025-55182 — React Server Components における Flight プロトコルデシリアライザーのプロトタイプ汚染によって引き起こされる深刻な（CVSS 10.0）リモートコード実行脆弱性。 免責事項: このリポジトリは教育および許可されたセキュリティ研究目的のみ...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607

Summary IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607. This bulletin contains information regarding these vulnerabilities and their...

Deserializer

Deserializer プロジェクトについて Deserializer は、Python エコシステム全体にわたる安全でないオブジェクト再構築および状態永続化のシンクを特定するために設計された、高度な抽象構文木 AST 静的解析エンジンです。AI、LLM、ロボティクス、データサイエンス、機械学習、深層学習の分野に特に重点を置いていますが、それらに限定されません。 Deserializer は、アプリ、スクリプト、フレームワーク、ライブラリ、Python pip パッケージなど、Python ソースコードに基づくあらゆる種類のプロジェクトをスキャンおよび解析するために設計されました。...

CLEANSTART-2026-DG88298 jackson-databind's deserializer for java

CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...

CLEANSTART-2026-KA44549 jackson-databind's deserializer for java

CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...

react2shell-poc

React2Shell - CVE-2025-55182 PoC CVE-2025-55182 に対する概念実証（PoC）です。これは、React Server Components における認証不要の重大なリモートコード実行（RCE）脆弱性です。 CVSS スコア: 10.0（Critical） 脆弱性 この脆弱性は、React の Flight プロトコルデシリアライザに存在します。特別に細工されたペイロードによるプロトタイプ汚染を悪用することで、攻撃者は脆弱な Next.js アプリケーション上で任意のコード実行を達成できます。 影響を受けるバージョン 製品| 影響を受ける| 修正...

tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer...

tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer...

tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer...

CLEANSTART-2026-GG40538 jackson-databind's deserializer for java

Multiple security vulnerabilities affect the trino package. jackson-databind's deserializer for java. See references for individual vulnerability details...

PT-2026-98430

Multiple security vulnerabilities affect the trino package. jackson-databind's deserializer for java. See references for individual vulnerability details...

Astra Linux – Vulnerability in Jackson-Databind

In FasterXML Jackson-Databind before version 2.13.4, resource exhaustion can occur due to the lack of a check in BeanDeserializer.deserializeFromArray, which prevents the use of deeply nested arrays. An application becomes vulnerable only with certain customized choices for deserialization...

CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

OSEC-2026-18 Marshal integer overflow leads to out-of-heap read

An integer overflow in the length-validation logic of OCaml's Marshal deserializer allows a crafted serialized object to bypass all bounds checks added by the CVE-2026-28364 fix, producing heap out-of-bounds reads from Marshal.frombytes / Marshal.fromstring and the C API camlinputvaluefromblock...

Uncontrolled Memory Allocation

Spring Integration is vulnerable to uncontrolled memory allocation. The vulnerability is due to the deserializer trusting the sender-supplied octet count and allocating a byte array of the specified size without an upper limit, which allows an attacker to send a maliciously large frame length and...

CVE-2026-19032

A flaw was found in jackson-databind. When deserializing java.nio.file.Path from untrusted JSON input, the deserializer resolves an attacker-supplied Uniform Resource Identifier URI without restricting the URI scheme. This allows a remote attacker to select and drive an arbitrary registered...

Linux Distros Unpatched Vulnerability : CVE-2026-19032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

OESA-2026-3572 tesseract security update

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fixes: Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model...

EUVD-2026-66839

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...