CVE-2020-9547

CVE-2020-9547: FasterXML/jackson-databind 원격 코드 실행 취약점...

CVE-2020-8840

CVE-2020-8840：FasterXML/jackson-databind 원격 코드 실행 취약점 0x00 개요 jackson-databind는 FasterXML 프로젝트 그룹의 JSON 처리 라이브러리입니다. 0x01 취약점 개요 2월 19일, NVD는 jackson-databind의 JNDI 주입으로 인한 원격 코드 실행 취약점CVE-2020-8840을 공개했으며, CVSS 점수는 9.8입니다. 영향을 받는 버전의 jackson-databind는 org.apache.xbean.propertyeditor.JndiConverte...

FasterXML jackson-databind - Deserialization Remote Code Execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap. This vulnerability allows attackers to execute arbitrary code through deserialization of...

FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig aka anteros-core. id: CVE-2020-9548 info: name: FasterXML Jackson Databind =2.9.10.4 - Remote Code Execution author: tomaquet18...

CVE-2020-9548

CVE-2020-9548：FasterXML/jackson-databind 원격 코드 실행 취약점...

jackson-CVE-2020-8840

CVE-2020-8840 FasterXML/jackson-databind 원격 코드 실행 취약점...

CVE-2020-36179

설명 CVE-2020-36179: FasterXML jackson-databind 2.x 버전 중 2.9.10.8 미만 버전은 직렬화 가젯과 타입 간의 상호작용을 잘못 처리하며, 이는 oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS와 관련됩니다. CVE-2020-36180: FasterXML jackson-databind 2.x 버전 중 2.9.10.8 미만 버전은 직렬화 가젯과 타입 간의 상호작용을 잘못 처리하며, 이는...

CVE-2020-36184

Description FasterXML jackson-databind 2.x 2.9.10.8 이전 버전은 직렬화 가젯과 타이핑 간의 상호작용을 잘못 처리하며, 이는 org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource와 관련이 있습니다. RCE 방법 pom.xml 4.0.0 com.jacksonTest jacksonTest 1.0-SNAPSHOT com.fasterxml.jackson.core jackson-databind 2.9.10.7 org.apache.tomca...

CVE-2020-14195

SimpleTest 이것은 FasterXML jackson-databind를 위한 간단한 테스트입니다...

Linux Distros Unpatched Vulnerability : CVE-2026-68496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary fails to invoke StreamReadConstraints.validateNameLength() when decoding JSON object property names. This allows an attacker to provide a Smile document with a property name of unbounded length , causing SmileParser._handleLongFieldName() t...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

EUVD-2026-90977

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary fails to invoke StreamReadConstraints.validateNameLength() when decoding JSON object property names. Specifically, CBORParser._decodeLongerName() decodes definite-length names without length checks, and CBORParser._decodeChunkedName() valida...

EUVD-2026-84498

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERNFLOAT via looksLikeValidNumber...

CVE-2026-68495: Allocation of Resources Without Limits or Throttling

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

EUVD-2026-85003

jackson-databind quadratic forward-reference completion...

CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...