Unsafe Polymorphic Deserialization

🗓️ 28 Sep 2026 08:21:06Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 27 Views

Unsafe polymorphic deserialization in jackson-databind allows instantiating arbitrary objects.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.1	14 Oct 202614:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind	14 Oct 202617:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Apache Log4j, FasterXML jackson-databind, FasterXML jackson-core, and Bouncy Castle libraries	14 Oct 202607:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to jackson-databind (CVE-2026-19032, CVE-2026-83557 and CVE-2026-68497)	29 Sep 202606:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	19 Oct 202618:43	–	ibm
IBM Security Bulletins	Security Bulletin:Multiple vulnerabilities in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-19032, CVE-2026-83557)	23 Oct 202608:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable with Jackson Databind library	28 Sep 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in Jackson package used by IBM Netezza Appliance	12 Oct 202607:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	28 Sep 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability has been detected in IBM Security Verify Governance Identity Manager Adapters	15 Oct 202606:37	–	ibm

Vulners

Node

fasterxml jackson-databindRange2.19.0–3.1.5java

fasterxml jackson-databindRange3.2.0–3.2.1java

fasterxml jackson-databindRange3.0.0–3.1.5java

fasterxml jackson-databindRange2.11.0.rc1–2.18.9java

fasterxml jackson-databindRange2.19.0-rc2–2.21.5java

fasterxml jackson-databindRange2.22.0–2.22.1java

fasterxml jackson-databindRange2.11.0–2.18.9java

fasterxml jackson-databindRange2.19.0–2.21.5java

Source	Link
github	www.github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f
github	www.github.com/FasterXML/jackson-databind/pull/6155
github	www.github.com/FasterXML/jackson-databind/issues/6156
github	www.github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j

29 Sep 2026 07:33Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.6

EPSS0.00717

SSVC