CLEANSTART-2026-GM79198 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the spark package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

CVE-2019-14439

CVE-2019-14439 Jackson-databind Ejecución Remota de Código...

jackson-CVE-2020-8840

CVE-2020-8840 FasterXML/jackson-databind 远程代码执行漏洞...

ROOT-APP-MAVEN-CVE-2026-54512 CVE-2026-54512 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54512 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54513 CVE-2026-54513 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54513 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54514 CVE-2026-54514 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54514 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54515 CVE-2026-54515 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54515 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

Demo-Exploit-Jackson-RCE

Demo-Exploit-Jackson-RCE 基于项目 jackson-rce-via-spel，本项目作为一个示例Web应用程序，用于测试针对Jackson-databind漏洞的多种攻击向量（文件上传、表单）。 介绍 基于Angular7前端和spring-boot后端，可以测试不同的攻击向量，并对结果进行可视化和检查。 构建 构建并打包spring boot和angular7成一个可部署的war文件。 mvn package 运行 运行后会自动在浏览器中打开 http://localhost:4200。 backend/mvn spring-boot:run 截图...

Security Bulletin: Vulnerability jackson-databind, golang.org/x/mod, image-size, bcprov-jdk18on, bcpkix-jdk18on, pyasn, setuptools, Mako, paramiko, http2-common Oct 2026v1

Summary jackson-databind CVE-2026-19032, CVE-2026-83557,CVE-2026-19032, golang.org/x/mod CVE-2026-56864, CVE-2026-56865, image-size CLEVOS-111792, bcprov-jdk18on CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13506, CVE-2026-13586, CVE-2026-14682, CVE-2026-15055,...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

CVE-2020-8840

CVE-2020-8840 Jackson-databind远程代码执行漏洞（CVE-2020-8840）分析复现环境代码。 项目包含： jackson-databind、Fastjson中payload WebServer恶意类 编译好的marshalsec-0.0.3-SNAPSHOT-all.jar 漏洞简介 Jackson-databind远程代码执行漏洞（CVE-2020-8840），攻击者可利用xbean-reflect的利用链（org.apache.xbean.propertyeditor.JndiConverter）触发JNDI远程类加载从而达到远程代码执行。...

ROOT-APP-MAVEN-CVE-2026-91777 CVE-2026-91777 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-91777 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

CVE-2020-8840

CVE-2020-8840：FasterXML/jackson-databind 远程代码执行漏洞 0x00 简介 jackson-databind 是隶属 FasterXML 项目组下的JSON处理库。 0x01 漏洞概述 2月19日，NVD发布安全通告披露了jackson-databind由JNDI注入导致的远程代码执行漏洞（CVE-2020-8840），CVSS评分为9.8...

CVE-2020-9547

CVE-2020-9547：FasterXML/jackson-databind 远程代码执行漏洞...

CVE-2019-12384

CVE-2019-12384 Jackson RCE 与 SSRF 0x01 python -m SimpleHTTPServer python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd throws java.io.IOException Stri...