FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig aka anteros-core. id: CVE-2020-9548 info: name: FasterXML Jackson Databind =2.9.10.4 - Remote Code Execution author: tomaquet18...

FasterXML jackson-databind - Deserialization Remote Code Execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap. This vulnerability allows attackers to execute arbitrary code through deserialization of...

CLEANSTART-2026-SQ73698 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

CLEANSTART-2026-DJ12675 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the sonarqube package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-CZ74700 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the sonarqube package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-OE47694 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the gradle package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

Security Bulletin: IBM Sterling Control Center has denial-of-service vulnerabilities in FasterXML jackson-databind due to Uncontrolled Resource Consumption (CVE-2026-91776, CVE-2026-91777)

Summary Multiple high-severity vulnerabilities have been identified in FasterXML jackson-databind. CVE-2026-91776 is a memory exhaustion vulnerability caused by unbounded caching of attacker-supplied, unrecognized polymorphic type identifiers when name-based polymorphic deserialization with a...

Security Bulletin: Vulnerability in FasterXML jackson-core affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in FasterXML jackson-core has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional...

Security Bulletin: IBM Sterling Control Center has denial-of-service vulnerabilities in FasterXML Jackson Core due to Uncontrolled Resource Consumption (CVE-2026-89407, CVE-2026-89425)

Summary Multiple high-severity vulnerabilities have been identified in FasterXML Jackson Core. CVE-2026-89407 may allow attackers to trigger excessive CPU consumption through specially crafted numeric inputs, resulting in a Denial-of-Service DoS condition. CVE-2026-89425 may lead to excessive...

CLEANSTART-2026-CU71812 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

CLEANSTART-2026-KI58922 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the elasticsearch package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-KF07294 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the elasticsearch package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-MU96054 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the sonarqube package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

FasterXML Jackson-DataFormat-Smile resource management error vulnerability

A resource management error vulnerability exists in FasterXML Jackson-DataFormat-Smile versions from 2.9.0 up to 2.18.12, from 2.19.0 up to 2.21.8, from 2.22.0 up to 2.22.4, from 3.0.0 up to 3.1.8, and from 3.2.0 up to 3.2.4. This vulnerability stems from the NonBlockingByteArrayParser asynchrono...

FasterXML jackson-dataformat-protobuf numeric error vulnerability

A numeric error vulnerability exists in FasterXML Jackson-DataFormat-ProtocolBuffer versions from 2.21.6 up to 2.21.8, from 2.22.0 up to 2.22.4, from 3.1.6 up to 3.1.8, and from 3.2.2 up to 3.2.4. This vulnerability arises because ProtobufParser.readStringKey utilizes signed arithmetic checks on...

FasterXML jackson-dataformat-protobuf numeric error vulnerability

A numerical error vulnerability exists in FasterXML Jackson-DataFormat-ProtocolBuffer versions from 2.6.0 up to and including 2.18.12, from 2.19.0 up to and including 2.21.8, from 2.22.0 up to and including 2.22.4, from 3.0.0 up to and including 3.1.8, and from 3.2.0 up to and including 3.2.4. Th...

FasterXML Jackson-Databind deserialization injection vulnerability

A deserialization injection vulnerability exists in FasterXML Jackson-Databind versions from 2.10.0 up to 2.18.12, from 2.19.0 up to 2.21.8, from 2.22.0 up to 2.22.4, from 3.0.0 up to 3.1.8, and from 3.2.0 up to 3.2.4. This vulnerability arises because external classes are validated for their...

CLEANSTART-2026-EA40241 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumptions in FasterXML jackson-core (CVE-2026-89407, CVE-2026-89425)

Summary IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumptions which can result in OutOfMemory Errors in FasterXML jackson-core. FasterXML jackson-core is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for...

Linux Distros Unpatched Vulnerability : CVE-2026-95155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by...