667 matches found
FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig aka anteros-core. id: CVE-2020-9548 info: name: FasterXML Jackson Databind =2.9.10.4 - Remote Code Execution author: tomaquet18...
FasterXML jackson-databind - Deserialization Remote Code Execution
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap. This vulnerability allows attackers to execute arbitrary code through deserialization of...
CVE-2026-95155
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...
CVE-2026-95155
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...
CLEANSTART-2026-WO73143 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...
CLEANSTART-2026-XU96478 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
CVE-2026-68496 affects multiple packages. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...
CLEANSTART-2026-OQ29524 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
CVE-2026-68495 affects multiple packages. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...
CVE-2026-95155
The FasterXML Jackson 1.x library is vulnerable to a Denial of Service (DoS) attack, specifically confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 . The root cause is uncontrolled recursion (CWE-674), where an attacker can supply deeply nested JSON input to an app...
CVE-2026-95155
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...
EUVD-2026-102127
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...
Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Apache Log4j, FasterXML jackson-databind, FasterXML jackson-core, and Bouncy Castle libraries
Summary IBM ApplinX is vulnerable to multiple vulnerabilities due to use of third-party libraries: Apache Log4j is vulnerable to an improper encoding or escaping of output vulnerability CVE-2026-49844; FasterXML jackson-databind is vulnerable to multiple uncontrolled resource consumption,...
CLEANSTART-2026-CH00220 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...
CLEANSTART-2026-AR08566 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
Security vulnerability affects the solr package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...
Important: jackson-core
Issue Overview: NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOAT +-?0-9\.?0-9+eE+-?0-9+?, present since 2.17.0, and PATTERNFLOATTRAILINGDOT, added in 2.17.2. PATTERNFLOAT places adjacent quantifiers over the...
CLEANSTART-2026-KZ87014 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...
CLEANSTART-2026-JS33298 flaw was discovered in FasterXML jackson-databind in all versions before 2
Security vulnerability affects the apache-hive package. A flaw was discovered in FasterXML jackson-databind in all versions before 2...
CLEANSTART-2026-YW54942 Fasterxml Jackson version Before 2
Security vulnerability affects the apache-hive package. Fasterxml Jackson version Before 2...
CLEANSTART-2026-QI59332 FasterXML jackson-databind 2
Security vulnerability affects the apache-hive package. FasterXML jackson-databind 2...