EUVD-2026-69250

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-77310

A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability by providing specially crafted input during data deserialization, specifically when java.net.InetAddress objects are processed. This causes the application to perform eager DNS resolution on attacker-controlled...

CVE-2020-14195

Простой тест Это простой тест для FasterXML jackson-databind...

UBUNTU-CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

EUVD-2026-68961

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032

CVE-2026-19032 affects jackson-databind , where the java.nio.file.Path deserializer (JDKFromStringDeserializer.NioPathHelper.deserialize) resolves an attacker-supplied URI without restricting its scheme. When Path.of(uri) throws FileSystemNotFoundException, the code enumerates ServiceLoader and c...

CVE-2026-19032 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

PT-2026-84082

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

PT-2026-84291

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2017-17485

CVE-2017-17485 CVE-2017-17485:Jackson-databind RCE...

CVE-2019-12086-jackson-databind-file-read

jackson-CVE-2019-12086 Описание уязвимости Если включен Default Typing, и в classpath присутствует mysql-connector-java версии 8.0.15 выпущен 2019.2.1 или ниже, злоумышленник может отправить вредоносные JSON-данные для чтения произвольных файлов. Библиотека mysql-connector-java — это популярный...

CVE-2020-36179

Описание CVE-2020-36179: FasterXML jackson-databind 2.x до версии 2.9.10.8 некорректно обрабатывает взаимодействие между гаджетами сериализации и типизацией, связан с oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. CVE-2020-36180: FasterXML jackson-databind 2.x до версии 2.9.10.8...

CVE-2020-11113

CVE-2020-11113 CVE-2020-11113:Jackson-databind RCE...

CVE-2020-36188

Описание FasterXML jackson-databind 2.x до версии 2.9.10.8 неправильно обрабатывает взаимодействие между сериализационными гаджетами и типизацией, связанное с com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource Как выполнить RCE pom.xml root@kitploit: com.fasterxml.jackson.core...

CVE-2020-10673

CVE-2020-10673 CVE-2020-10673:jackson-databind RCE...

CVE-2020-36184

説明 FasterXML jackson-databind 2.x（2.9.10.8 より前）は、シリアル化ガジェットと型指定の間の相互作用を誤って処理します。これは、org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource に関連しています。 RCEの方法 pom.xml root@kitploit: 4.0.0 com.jacksonTest jacksonTest 1.0-SNAPSHOT com.fasterxml.jackson.core jackson-databind 2.9.10.7...

CVE-2020-35728

Описание FasterXML jackson-databind версии 2.x до 2.9.10.8 некорректно обрабатывает взаимодействие между сериализационными гаджетами и типизацией, связанную с com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool также известный как встроенный Xalan в...

ROOT-APP-MAVEN-CVE-2021-46877 CVE-2021-46877 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2021-46877 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...