Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups fo...

CVE-2026-41731

A flaw was found in the spring-kafka component. A remote attacker, by supplying crafted header values, could exploit a vulnerability in JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper that incorrectly matched type headers against trusted packages. This issue, combined with Jackson's default be...

Unsafe Deserialization

Spring for Apache Kafka is vulnerable to an unsafe deserialization. The vulnerability is due to improper trusted-package matching in JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper, where prefix-based checks implicitly trusted subpackages and, combined with Jackson's default bea...

EUVD-2026-35908

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

CVE-2026-40899

DataEase

CVE-2026-40899: Permissive List of Allowed Inputs

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the...

Apache Spark Deserialization Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computing from the Apache Foundation. Apache Spark suffers from a deserialization vulnerability. The vulnerability stems from the Spark History Web UI's overly lax Jackson deserialization of...

EUVD-2025-208669

This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the Jackson implementation in the Spark History Server web UI. An attacker who can write event logs can achieve code execution by injecting malicious JSON payloads into event log files, which are the...

CVE-2025-54920 Apache Spark: Spark History Server Code Execution Vulnerability

This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson...

CVE-2025-54920

This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson...

CVE-2025-54920

This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson...

CVE-2025-54920

Apache Spark versions before 3.5.7 and 4.0.1 are vulnerable to a code execution vulnerability within the Spark History Web UI . The root cause is overly permissive Jackson polymorphic deserialization of event log data using @JsonTypeInfo.Id.CLASS on SparkListenerEvent objects. This flaw allows an...

Apache Spark 代码问题漏洞

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computing from the Apache Foundation. Apache Spark suffers from a deserialization vulnerability. The vulnerability stems from the Spark History Web UI's overly lax Jackson deserialization of...

Exploit for Incomplete List of Disallowed Inputs in Fasterxml Jackson-Databind

🔥 Jackson RCE Exploiter - Enterprise Bypass Edition !Versi...

PT-2025-34835 · Git · Json2Avro

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=438873397 Crash type: Security exception Crash state: com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.deser com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.mapOb...

PT-2026-25504

Name of the Vulnerable Software and Affected Versions Apache Spark versions prior to 3.5.7 and 4.0.1 Description Apache Spark 3.5.4 and earlier versions contain a code execution issue in the Spark History Web UI. This is due to overly permissive Jackson deserialization of event log data. An...

json2avro:ConverterFuzzer: Security exception in com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.deser

Project: https://github.com/allegro/json-avro-converter.git Detailed Report: https://oss-fuzz.com/testcase?key=4514288585539584 Project: json2avro Fuzzing Engine: libFuzzer Fuzz Target: ConverterFuzzer Job Type: libfuzzerasanjson2avro Platform Id: linux Crash Type: Security exception Crash Addres...

SUSE CVE-2018-19361

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization...

apache-commons-configuration:JSONConfigurationReadFuzzer: Security exception in com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla._mapO

Detailed Report: https://oss-fuzz.com/testcase?key=4763845192712192 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: JSONConfigurationReadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Security exception Crash Address: Crash...