CVE-2026-47875

Spring Batch (org.springframework.batch:spring-batch-core) versions 6.0.0–6.0.4 and 5.2.0–5.2.6 are vulnerable to deserialization of untrusted data in the JobParameterDeserializer. When Jackson2ExecutionContextStringSerializer is used with an untrusted job repository data source, the deserializer...

PT-2026-82395

Name of the Vulnerable Software and Affected Versions Spring Batch versions 6.0.0 through 6.0.4 Spring Batch versions 5.2.0 through 5.2.6 Description Applications using Jackson2ExecutionContextStringSerializer to deserialize execution contexts are susceptible to a deserialization attack when an...

Vulnerabilities hidden within Keycloak

Red Hat has addressed several vulnerabilities in Keycloak. The vulnerability with CVE-2026-18963 allows an unauthorized external attacker to force a password reset for any user account, thereby enabling them to take control of that account. This vulnerability exposes the email verification proces...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the STDINETADDRESS branch in FromStringDeserializer in src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java. An attacker can trigger outbound DNS lookups and blind...

Server-side Request Forgery (SSRF)

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the STDINETADDRESS branch in...

CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

UBUNTU-CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

EUVD-2026-65088

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310

jackson-databind (FasterXML Jackson Data Processor) is affected by an incomplete fix for CVE-2026-54514. The java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization. Th...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

ROOT-APP-MAVEN-CVE-2020-36186 CVE-2020-36186 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-36186 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-36187 CVE-2020-36187 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-36187 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-10650 CVE-2020-10650 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-10650 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2021-20190 CVE-2021-20190 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2021-20190 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2017-17485 CVE-2017-17485 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2017-17485 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2018-7489 CVE-2018-7489 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2018-7489 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...