674 matches found
FasterXML jackson-databind - Deserialization Remote Code Execution
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap. This vulnerability allows attackers to execute arbitrary code through deserialization of...
FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig aka anteros-core. id: CVE-2020-9548 info: name: FasterXML Jackson Databind =2.9.10.4 - Remote Code Execution author: tomaquet18...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumptions in FasterXML jackson-core (CVE-2026-89407, CVE-2026-89425)
Summary IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumptions which can result in OutOfMemory Errors in FasterXML jackson-core. FasterXML jackson-core is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for...
CVE-2026-95155
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...
CVE-2026-95155
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...
FasterXML Jackson-core resource management vulnerability
FasterXML Jackson-core versions prior to 2.16.0 through 2.18.10, 2.19.0 through 2.21.6, 2.22.0 through 2.22.2, 3.0.0 through 3.1.6, and 3.2.0 through 3.2.2 contain a resource management vulnerability. This vulnerability arises from the character input parser failing to apply the maxNameLength lim...
CLEANSTART-2026-WO73143 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...
CLEANSTART-2026-OQ29524 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
CVE-2026-68495 affects multiple packages. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...
CLEANSTART-2026-XU96478 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
CVE-2026-68496 affects multiple packages. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...
CVE-2026-95155: Uncontrolled Recursion
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...
PT-2026-114977
Name of the Vulnerable Software and Affected Versions jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 Description An issue exists where attackers can cause a denial of service by providing deeply nested JSON input to an application that deserializes untrusted JSON using the...
EUVD-2026-102127
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...
CVE-2026-95155
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...
CVE-2026-95155
The FasterXML Jackson 1.x library is vulnerable to a Denial of Service (DoS) attack, specifically confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 . The root cause is uncontrolled recursion (CWE-674), where an attacker can supply deeply nested JSON input to an app...
Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Apache Log4j, FasterXML jackson-databind, FasterXML jackson-core, and Bouncy Castle libraries
Summary IBM ApplinX is vulnerable to multiple vulnerabilities due to use of third-party libraries: Apache Log4j is vulnerable to an improper encoding or escaping of output vulnerability CVE-2026-49844; FasterXML jackson-databind is vulnerable to multiple uncontrolled resource consumption,...
CLEANSTART-2026-CH00220 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...
CLEANSTART-2026-AR08566 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
Security vulnerability affects the solr package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...
Important: jackson-core
Issue Overview: NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOAT +-?0-9\.?0-9+eE+-?0-9+?, present since 2.17.0, and PATTERNFLOATTRAILINGDOT, added in 2.17.2. PATTERNFLOAT places adjacent quantifiers over the...
CLEANSTART-2026-KZ87014 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...