jackson-CVE-2020-8840

CVE-2020-8840 FasterXML/jackson-databind 远程代码执行漏洞...

CVE-2020-9548

CVE-2020-9548：FasterXML/jackson-databind 远程代码执行漏洞...

FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig aka anteros-core. id: CVE-2020-9548 info: name: FasterXML Jackson Databind =2.9.10.4 - Remote Code Execution author: tomaquet18...

FasterXML jackson-databind - Deserialization Remote Code Execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap. This vulnerability allows attackers to execute arbitrary code through deserialization of...

CVE-2020-9547

CVE-2020-9547：FasterXML/jackson-databind 远程代码执行漏洞...

CVE-2020-8840

CVE-2020-8840：FasterXML/jackson-databind 远程代码执行漏洞 0x00 简介 jackson-databind 是隶属 FasterXML 项目组下的JSON处理库。 0x01 漏洞概述 2月19日，NVD发布安全通告披露了jackson-databind由JNDI注入导致的远程代码执行漏洞（CVE-2020-8840），CVSS评分为9.8...

CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...

CVE-2026-91777

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

DEBIAN-CVE-2026-91776

TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unrecognized type ID...

DEBIAN-CVE-2026-91777

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

EUVD-2026-85003

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

CVE-2026-91777

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

CVE-2026-89407

NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOAT +-?0-9.?0-9+eE+-?0-9+?, present since 2.17.0, and PATTERNFLOATTRAILINGDOT, added in 2.17.2. PATTERNFLOAT places adjacent quantifiers over the same character...

EUVD-2026-84498

NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOAT +-?0-9.?0-9+eE+-?0-9+?, present since 2.17.0, and PATTERNFLOATTRAILINGDOT, added in 2.17.2. PATTERNFLOAT places adjacent quantifiers over the same character...

CVE-2026-89407

FasterXML jackson-core (versions 2.17.0+) is vulnerable to a ReDoS (Regular Expression Denial of Service) in NumberInput.looksLikeValidNumber(). The PATTERN_FLOAT regex uses adjacent quantifiers over the same character class, causing quadratic backtracking when an input ultimately fails to match....

CVE-2020-36179

Description CVE-2020-36179： FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. CVE-2020-36180： FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the...

CVE-2020-36184

描述 FasterXML jackson-databind 2.x 版本在 2.9.10.8 之前错误地处理了序列化 gadgets 与 typing 之间的交互，与 org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource 相关。 如何实现 RCE pom.xml root@kitploit: 4.0.0 com.jacksonTest jacksonTest 1.0-SNAPSHOT com.fasterxml.jackson.core jackson-databind 2.9.10.7...

CVE-2020-14195

SimpleTest 这是为 FasterXML jackson-databind 进行的简单测试。...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091397)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091397 advisory. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. Tenable has extracted the...

Fedora 45 : fasterxml-oss-parent / jackson-annotations / jackson-bom / etc (2026-ddde3cf003)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-ddde3cf003 advisory. Rebase to 2.21.5 to solve the CVE-2026-54518, CVE-2026-54517, CVE-2026-54516, CVE-2026-54515, CVE-2026-54513, CVE-2026-54512 Tenable has extracted t...