CVE-2022-23884

CVE-2022-23884 There is a network-layer vulnerabilities in the official server of Minecraft: Bedrock Edition aka Bedrock Server,which allow attacker to launch a DoS attack. CVE-2022-23884 Mojang Bedrock Dedicated Server 1.16.0-1.18.12 is affected by an large loop and crash server caused by...

react-rsc-cve-2025-55182-lab

CVE-2025-55182 Lab — React Server Components RCE Educational lab demonstrating CVE-2025-55182 — a critical CVSS 10.0 Remote Code Execution vulnerability in React Server Components caused by prototype pollution in the Flight protocol deserializer. Disclaimer: This repository is for educational and...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607

Summary IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607. This bulletin contains information regarding these vulnerabilities and their...

Deserializer

Deserializer About the Project Deserializer is an advanced Abstract Syntax Tree AST static analysis engine designed to identify insecure object reconstruction and state persistence sinks across the Python ecosystem, with strong focus on AI, LLM, Robotics, Data Science, Machine Learning and Deep...

CLEANSTART-2026-DG88298 jackson-databind's deserializer for java

CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...

CLEANSTART-2026-KA44549 jackson-databind's deserializer for java

CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...

react2shell-poc

React2Shell - PoC de CVE-2025-55182 Preuve de concept pour CVE-2025-55182 , une vulnérabilité critique non authentifiée d'exécution de code à distance dans les composants serveur React. Score CVSS : 10,0 Critique Vulnérabilité La vulnérabilité réside dans le désérialiseur du protocole Flight de...

tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer...

tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer...

tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer...

CLEANSTART-2026-GG40538 jackson-databind's deserializer for java

Multiple security vulnerabilities affect the trino package. jackson-databind's deserializer for java. See references for individual vulnerability details...

PT-2026-98430

Multiple security vulnerabilities affect the trino package. jackson-databind's deserializer for java. See references for individual vulnerability details...

Astra Linux – Vulnerability in Jackson-Databind

In FasterXML Jackson-Databind before version 2.13.4, resource exhaustion can occur due to the lack of a check in BeanDeserializer.deserializeFromArray, which prevents the use of deeply nested arrays. An application becomes vulnerable only with certain customized choices for deserialization...

CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

OSEC-2026-18 Marshal integer overflow leads to out-of-heap read

An integer overflow in the length-validation logic of OCaml's Marshal deserializer allows a crafted serialized object to bypass all bounds checks added by the CVE-2026-28364 fix, producing heap out-of-bounds reads from Marshal.frombytes / Marshal.fromstring and the C API camlinputvaluefromblock...

Uncontrolled Memory Allocation

Spring Integration is vulnerable to uncontrolled memory allocation. The vulnerability is due to the deserializer trusting the sender-supplied octet count and allocating a byte array of the specified size without an upper limit, which allows an attacker to send a maliciously large frame length and...

CVE-2026-19032

A flaw was found in jackson-databind. When deserializing java.nio.file.Path from untrusted JSON input, the deserializer resolves an attacker-supplied Uniform Resource Identifier URI without restricting the URI scheme. This allows a remote attacker to select and drive an arbitrary registered...

Linux Distros Unpatched Vulnerability : CVE-2026-19032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

OESA-2026-3572 tesseract security update

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fixes: Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model...

EUVD-2026-66839

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...