CVE-2026-77310

A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability by providing specially crafted input during data deserialization, specifically when java.net.InetAddress objects are processed. This causes the application to perform eager DNS resolution on attacker-controlled...

WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Denver Jackson in WordPress Plugin Booking Hub versions = 1.3.1...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' through NioPathDeserializer in src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java. An attacker can force readValue to resolve an...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe...

UBUNTU-CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

DEBIAN-CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

EUVD-2026-68961

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032

CVE-2026-19032 affects jackson-databind , where the java.nio.file.Path deserializer (JDKFromStringDeserializer.NioPathHelper.deserialize) resolves an attacker-supplied URI without restricting its scheme. When Path.of(uri) throws FileSystemNotFoundException, the code enumerates ServiceLoader and c...

CVE-2026-19032 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

PT-2026-84082

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

PT-2026-84291

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

ROOT-APP-MAVEN-CVE-2020-36518 CVE-2020-36518 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-36518 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2021-46877 CVE-2021-46877 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2021-46877 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54512 CVE-2026-54512 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54512 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54513 CVE-2026-54513 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54513 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-42003 CVE-2022-42003 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2022-42003 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-42004 CVE-2022-42004 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2022-42004 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-77310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1,...