com.fasterxml.jackson.core:jackson-databind (Maven)
Advisories
203
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.1.4 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.1.4</version></dependency>gradle
implementation("com.fasterxml.jackson.core:jackson-databind:3.1.4")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-cxp5-3px4-pw24 jackson-databind quadratic forward-reference completion |
High EPSS 0.49% |
>= 2.19.0, < 2.21.7 | 2.21.7 |
| GHSA-cxp5-3px4-pw24 jackson-databind quadratic forward-reference completion |
High EPSS 0.49% |
>= 2.22.0, < 2.22.3 | 2.22.3 |
| GHSA-cxp5-3px4-pw24 jackson-databind quadratic forward-reference completion |
High EPSS 0.49% |
>= 2.5.0, < 2.18.11 | 2.18.11 |
| GHSA-wv8q-qhhj-9h54 jackson-databind retains every unknown raw type ID |
High EPSS 0.49% |
>= 2.22.0, < 2.22.3 | 2.22.3 |
| GHSA-wv8q-qhhj-9h54 jackson-databind retains every unknown raw type ID |
High EPSS 0.49% |
>= 2.0.0, < 2.18.11 | 2.18.11 |
| GHSA-wv8q-qhhj-9h54 jackson-databind retains every unknown raw type ID |
High EPSS 0.49% |
>= 2.19.0, < 2.21.7 | 2.21.7 |
| GHSA-q4xh-88c3-wmh7 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS |
High EPSS 0.63% |
>= 2.14.0, < 2.18.10 | 2.18.10 |
| GHSA-q4xh-88c3-wmh7 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS |
High EPSS 0.63% |
>= 2.19.0, < 2.21.6 | 2.21.6 |
| GHSA-q4xh-88c3-wmh7 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS |
High EPSS 0.63% |
>= 2.22.0, < 2.22.2 | 2.22.2 |
| GHSA-gx83-3vf8-gh7j jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) |
Medium EPSS 0.72% |
>= 2.22.0, < 2.22.2 | 2.22.2 |
| GHSA-gx83-3vf8-gh7j jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) |
Medium EPSS 0.72% |
>= 2.11.0, < 2.18.10 | 2.18.10 |
| GHSA-gx83-3vf8-gh7j jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) |
Medium EPSS 0.72% |
>= 2.19.0, < 2.21.6 | 2.21.6 |
| GHSA-wjgm-6hv5-3cvf jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution |
Medium EPSS 0.57% |
>= 2.22.0, < 2.22.2 | 2.22.2 |
| GHSA-wjgm-6hv5-3cvf jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution |
Medium EPSS 0.57% |
>= 2.8.0, < 2.18.10 | 2.18.10 |
| GHSA-wjgm-6hv5-3cvf jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution |
Medium EPSS 0.57% |
>= 2.19.0, < 2.21.6 | 2.21.6 |
| GHSA-vvgp-rfg2-7rr6 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization |
Medium EPSS 0.31% |
>= 2.0.0, < 2.18.9 | 2.18.9 |
| GHSA-vvgp-rfg2-7rr6 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization |
Medium EPSS 0.31% |
>= 2.22.0, < 2.22.1 | 2.22.1 |
| GHSA-vvgp-rfg2-7rr6 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization |
Medium EPSS 0.31% |
>= 2.19.0, < 2.21.5 | 2.21.5 |
| GHSA-mhm7-754m-9p8w jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)` |
Medium | >= 2.21.0, < 2.21.5 | 2.21.5 |
| GHSA-mhm7-754m-9p8w jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)` |
Medium | >= 2.18.0, < 2.18.9 | 2.18.9 |
| GHSA-5gvw-p9qm-jgwh jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization |
Medium EPSS 0.35% |
>= 2.0.0-RC1, < 2.18.9 | 2.18.9 |
| GHSA-5gvw-p9qm-jgwh jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization |
Medium EPSS 0.35% |
>= 2.22.0, < 2.22.1 | 2.22.1 |
| GHSA-5gvw-p9qm-jgwh jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization |
Medium EPSS 0.35% |
>= 2.19.0, < 2.21.5 | 2.21.5 |
| GHSA-3pjw-73gf-8qr5 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy |
Medium EPSS 0.42% |
>= 2.19.0, < 2.21.4 | 2.21.4 |
| GHSA-3pjw-73gf-8qr5 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy |
Medium EPSS 0.42% |
>= 2.15.0, < 2.18.8 | 2.18.8 |
| GHSA-5hh8-q8hv-fr38 jackson-databind has @JsonView bypass for setterless creator properties |
Medium EPSS 0.38% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-5hh8-q8hv-fr38 jackson-databind has @JsonView bypass for setterless creator properties |
Medium EPSS 0.38% |
>= 2.21.0, < 2.21.4 | 2.21.4 |
| GHSA-9fxm-vc8v-hj55 jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields |
Medium EPSS 0.45% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-9fxm-vc8v-hj55 jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields |
Medium EPSS 0.45% |
>= 2.21.0, < 2.21.4 | 2.21.4 |
| GHSA-5jmj-h7xm-6q6v jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties |
Medium EPSS 0.44% |
>= 2.19.0, < 2.21.5 | 2.21.5 |
| GHSA-5jmj-h7xm-6q6v jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties |
Medium EPSS 0.44% |
>= 2.8.0, < 2.18.9 | 2.18.9 |
| GHSA-5jmj-h7xm-6q6v jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties |
Medium EPSS 0.44% |
>= 3.1.0, < 3.1.4 | 3.1.4 |
| GHSA-5jmj-h7xm-6q6v jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties |
Medium EPSS 0.44% |
>= 2.22.0, < 2.22.1 | 2.22.1 |
| GHSA-hgj6-7826-r7m5 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) |
Medium EPSS 0.37% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-hgj6-7826-r7m5 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) |
Medium EPSS 0.37% |
>= 2.0.0, < 2.18.8 | 2.18.8 |
| GHSA-hgj6-7826-r7m5 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) |
Medium EPSS 0.37% |
>= 2.19.0, < 2.21.4 | 2.21.4 |
| GHSA-rmj7-2vxq-3g9f jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) |
High EPSS 1.23% |
>= 2.10.0, < 2.18.8 | 2.18.8 |
| GHSA-rmj7-2vxq-3g9f jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) |
High EPSS 1.23% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-rmj7-2vxq-3g9f jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) |
High EPSS 1.23% |
>= 2.19.0, < 2.21.4 | 2.21.4 |
| GHSA-j3rv-43j4-c7qm jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation |
High EPSS 1.20% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-j3rv-43j4-c7qm jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation |
High EPSS 1.20% |
>= 2.10.0, < 2.18.8 | 2.18.8 |
| GHSA-j3rv-43j4-c7qm jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation |
High EPSS 1.20% |
>= 2.19.0, < 2.21.4 | 2.21.4 |
| GHSA-rcqc-6cw3-h962 jackson-databind has a @JsonView bypass for unwrapped creator parameters |
Medium EPSS 0.35% |
>= 2.21.0, < 2.21.4 | 2.21.4 |
| GHSA-3wrr-7qpf-2prh jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() |
High EPSS 0.62% |
>= 2.10.0, < 2.14.0 | 2.14.0 |
| GHSA-3x8x-79m2-3w2w jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode |
High EPSS 1.12% |
>= 2.10.0, < 2.12.6 | 2.12.6 |
| GHSA-3x8x-79m2-3w2w jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode |
High EPSS 1.12% |
>= 2.13.0, < 2.13.1 | 2.13.1 |
| GHSA-rgv9-q543-rqg4 Uncontrolled Resource Consumption in FasterXML jackson-databind |
High EPSS 3.41% |
>= 2.13.0, < 2.13.4 | 2.13.4 |
| GHSA-rgv9-q543-rqg4 Uncontrolled Resource Consumption in FasterXML jackson-databind |
High EPSS 3.41% |
>= 2.4.0-rc1, < 2.12.7.1 | 2.12.7.1 |
| GHSA-jjjh-jjxp-wpff Uncontrolled Resource Consumption in Jackson-databind |
High EPSS 3.41% |
>= 2.4.0-rc1, < 2.12.7.1 | 2.12.7.1 |
| GHSA-jjjh-jjxp-wpff Uncontrolled Resource Consumption in Jackson-databind |
High EPSS 3.41% |
>= 2.13.0, < 2.13.4.2 | 2.13.4.2 |
| GHSA-rpr3-cw39-3pxh jackson-databind vulnerable to unsafe deserialization |
High EPSS 3.60% |
< 2.9.10.4 | 2.9.10.4 |
| GHSA-57j2-w4cx-62h2 Deeply nested json in jackson-databind |
High EPSS 4.86% |
>= 2.13.0, < 2.13.2.1 | 2.13.2.1 |
| GHSA-57j2-w4cx-62h2 Deeply nested json in jackson-databind |
High EPSS 4.86% |
< 2.12.6.1 | 2.12.6.1 |
| GHSA-vfqx-33qm-g869 Unsafe Deserialization in jackson-databind |
High EPSS 3.99% |
< 2.6.7.5 | 2.6.7.5 |
| GHSA-vfqx-33qm-g869 Unsafe Deserialization in jackson-databind |
High EPSS 3.99% |
>= 2.7.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-r695-7vr9-jgc2 Unsafe Deserialization in jackson-databind |
High EPSS 4.24% |
>= 2.0.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-f9xh-2qgp-cq57 Unsafe Deserialization in jackson-databind |
High EPSS 8.79% |
>= 2.7.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-f9xh-2qgp-cq57 Unsafe Deserialization in jackson-databind |
High EPSS 8.79% |
>= 2.0.0, < 2.6.7.5 | 2.6.7.5 |
| GHSA-9m6f-7xcq-8vf8 Unsafe Deserialization in jackson-databind |
High EPSS 4.97% |
>= 2.7.00, < 2.9.10.8 | 2.9.10.8 |
| GHSA-9m6f-7xcq-8vf8 Unsafe Deserialization in jackson-databind |
High EPSS 4.97% |
>= 2.0.0, < 2.6.7.5 | 2.6.7.5 |
| GHSA-m6x4-97wx-4q27 Unsafe Deserialization in jackson-databind |
High EPSS 8.36% |
>= 2.0.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-8c4j-34r4-xr8g Unsafe Deserialization in jackson-databind |
High EPSS 4.09% |
>= 2.7.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-8c4j-34r4-xr8g Unsafe Deserialization in jackson-databind |
High EPSS 4.09% |
>= 2.0.0, < 2.6.7.5 | 2.6.7.5 |
| GHSA-cvm9-fjm9-3572 Unsafe Deserialization in jackson-databind |
High EPSS 4.09% |
>= 2.7.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-cvm9-fjm9-3572 Unsafe Deserialization in jackson-databind |
High EPSS 4.09% |
>= 2.0.0, < 2.6.7.5 | 2.6.7.5 |
| GHSA-8w26-6f25-cm9x Unsafe Deserialization in jackson-databind |
High EPSS 4.24% |
>= 2.0.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-9gph-22xh-8x98 Unsafe Deserialization in jackson-databind |
High EPSS 17.07% |
>= 2.0.0, < 2.6.7.5 | 2.6.7.5 |
| GHSA-9gph-22xh-8x98 Unsafe Deserialization in jackson-databind |
High EPSS 17.07% |
>= 2.7.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-89qr-369f-5m5x Unsafe Deserialization in jackson-databind |
High EPSS 4.09% |
>= 2.0.0, < 2.6.7.5 | 2.6.7.5 |
| GHSA-89qr-369f-5m5x Unsafe Deserialization in jackson-databind |
High EPSS 4.09% |
>= 2.7.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-qjw2-hr98-qgfh Unsafe Deserialization in jackson-databind |
High EPSS 7.33% |
>= 2.7.0, < 2.9.10.6 | 2.9.10.6 |
| GHSA-qjw2-hr98-qgfh Unsafe Deserialization in jackson-databind |
High EPSS 7.33% |
>= 2.0, < 2.6.7.5 | 2.6.7.5 |
| GHSA-5r5r-6hpj-8gg9 Serialization gadget exploit in jackson-databind |
High EPSS 12.50% |
>= 2.0.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-r3gr-cxrf-hg25 Serialization gadgets exploit in jackson-databind |
High EPSS 7.75% |
>= 2.0.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-wh8g-3j2c-rqj5 Serialization gadgets exploit in jackson-databind |
High EPSS 6.29% |
>= 2.0.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-h3cw-g4mq-c5x2 Code Injection in jackson-databind |
High EPSS 7.61% |
>= 2.0.0, < 2.9.10.6 | 2.9.10.6 |
| GHSA-v585-23hc-c647 Unsafe Deserialization in jackson-databind |
High EPSS 4.24% |
>= 2.0.0, < 2.9.10.8 | 2.9.10.8 |
| GHSA-288c-cq4h-88gq XML External Entity (XXE) Injection in Jackson Databind |
High EPSS 17.71% |
>= 2.6.0, < 2.6.7.4 | 2.6.7.4 |
| GHSA-288c-cq4h-88gq XML External Entity (XXE) Injection in Jackson Databind |
High EPSS 17.71% |
>= 2.7.0.0, < 2.9.10.7 | 2.9.10.7 |
| GHSA-288c-cq4h-88gq XML External Entity (XXE) Injection in Jackson Databind |
High EPSS 17.71% |
>= 2.10.0.0, < 2.10.5.1 | 2.10.5.1 |
| GHSA-5949-rw7g-wx7w Deserialization of untrusted data in jackson-databind |
High EPSS 7.57% |
< 2.6.7.5 | 2.6.7.5 |
| GHSA-5949-rw7g-wx7w Deserialization of untrusted data in jackson-databind |
High EPSS 7.57% |
>= 2.7.0, < 2.9.10.7 | 2.9.10.7 |
| GHSA-w3f4-3q6j-rh82 Deserialization of Untrusted Data in jackson-databind |
High EPSS 7.25% |
>= 2.8.0, < 2.8.11.1 | 2.8.11.1 |
| GHSA-w3f4-3q6j-rh82 Deserialization of Untrusted Data in jackson-databind |
High EPSS 7.25% |
< 2.7.9.5 | 2.7.9.5 |
| GHSA-w3f4-3q6j-rh82 Deserialization of Untrusted Data in jackson-databind |
High EPSS 7.25% |
>= 2.9.0, < 2.9.4 | 2.9.4 |
| GHSA-c2q3-4qrh-fm48 Deserialization of untrusted data in Jackson Databind |
High EPSS 4.46% |
>= 2.9.0, < 2.9.10.5 | 2.9.10.5 |
| GHSA-c265-37vj-cwcc Deserialization of untrusted data in Jackson Databind |
High EPSS 8.11% |
>= 2.9.0, < 2.9.10.5 | 2.9.10.5 |
| GHSA-j823-4qch-3rgm Deserialization of untrusted data in Jackson Databind |
High EPSS 8.54% |
>= 2.9.0, < 2.9.10.5 | 2.9.10.5 |
| GHSA-mc6h-4qgp-37qh Deserialization of untrusted data in Jackson Databind |
High EPSS 4.55% |
>= 2.9.0, < 2.9.10.5 | 2.9.10.5 |
| GHSA-wrr7-33fx-rcvj Deserialization of Untrusted Data in jackson-databind Withdrawn |
High | >= 2.7.0, < 2.7.9.4 | 2.7.9.4 |
| GHSA-wrr7-33fx-rcvj Deserialization of Untrusted Data in jackson-databind Withdrawn |
High | >= 2.8.0, < 2.8.11.2 | 2.8.11.2 |
| GHSA-wrr7-33fx-rcvj Deserialization of Untrusted Data in jackson-databind Withdrawn |
High | >= 2.9.0, < 2.9.6 | 2.9.6 |
| GHSA-6wqp-v4v6-c87c Deserialization of Untrusted Data |
High EPSS 8.87% |
>= 2.8.0, < 2.8.11.2 | 2.8.11.2 |
| GHSA-6wqp-v4v6-c87c Deserialization of Untrusted Data |
High EPSS 8.87% |
>= 2.7.0, < 2.7.9.4 | 2.7.9.4 |
| GHSA-6wqp-v4v6-c87c Deserialization of Untrusted Data |
High EPSS 8.87% |
>= 2.9.0, < 2.9.6 | 2.9.6 |
| GHSA-f3j5-rmmp-3fc5 Improper Input Validation in jackson-databind |
Critical EPSS 4.63% |
< 2.8.11.5 | 2.8.11.5 |
| GHSA-f3j5-rmmp-3fc5 Improper Input Validation in jackson-databind |
Critical EPSS 4.63% |
>= 2.9.0, < 2.9.10 | 2.9.10 |
| GHSA-58pp-9c76-5625 jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 3.64% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-q93h-jc49-78gg jackson-databind mishandles the interaction between serialization gadgets and typing |
Critical EPSS 18.38% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-q93h-jc49-78gg jackson-databind mishandles the interaction between serialization gadgets and typing |
Critical EPSS 18.38% |
>= 2.8.0, < 2.8.11.6 | 2.8.11.6 |
| GHSA-q93h-jc49-78gg jackson-databind mishandles the interaction between serialization gadgets and typing |
Critical EPSS 18.38% |
>= 2.0.0, < 2.7.9.7 | 2.7.9.7 |
| GHSA-qmqc-x3r4-6v39 Polymorphic deserialization of malicious object in jackson-databind |
High EPSS 4.09% |
>= 2.9.0, < 2.9.10 | 2.9.10 |
| GHSA-fqwf-pjwf-7vqv jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 8.03% |
>= 2.7.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-fqwf-pjwf-7vqv jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 8.03% |
>= 2.0.0, < 2.6.7.4 | 2.6.7.4 |
| GHSA-p43x-xfjf-5jhr jackson-databind mishandles the interaction between serialization gadgets and typing |
Critical EPSS 18.92% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-p43x-xfjf-5jhr jackson-databind mishandles the interaction between serialization gadgets and typing |
Critical EPSS 18.92% |
>= 2.0.0, < 2.7.9.7 | 2.7.9.7 |
| GHSA-p43x-xfjf-5jhr jackson-databind mishandles the interaction between serialization gadgets and typing |
Critical EPSS 18.92% |
>= 2.8.0, < 2.8.11.6 | 2.8.11.6 |
| GHSA-cf6r-3wgc-h863 Polymorphic deserialization of malicious object in jackson-databind |
High EPSS 5.58% |
< 2.6.7.3 | 2.6.7.3 |
| GHSA-cf6r-3wgc-h863 Polymorphic deserialization of malicious object in jackson-databind |
High EPSS 5.58% |
>= 2.9.0, < 2.9.10 | 2.9.10 |
| GHSA-cf6r-3wgc-h863 Polymorphic deserialization of malicious object in jackson-databind |
High EPSS 5.58% |
>= 2.7.0, < 2.8.11.5 | 2.8.11.5 |
| GHSA-rf6r-2c4q-2vwg jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 3.66% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-v3xw-c963-f5hc jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 3.61% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-9vvp-fxw6-jcxr jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 6.28% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-27xj-rqx5-2255 jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 3.68% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-758m-v56v-grj4 jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 3.56% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-5p34-5m6p-p58g jackson-databind mishandles the interaction between serialization gadgets and typing |
Critical EPSS 4.58% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-h4rc-386g-6m85 jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 5.73% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-95cm-88f5-f2c7 jackson-databind mishandles the interaction between serialization gadgets and typing |
High EPSS 3.06% |
>= 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| GHSA-4w82-r329-3q67 Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 26.59% |
>= 2.9.0, < 2.9.10.3 | 2.9.10.3 |
| GHSA-4w82-r329-3q67 Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 26.59% |
>= 2.0.0, < 2.6.7.4 | 2.6.7.4 |
| GHSA-4w82-r329-3q67 Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 26.59% |
>= 2.8.0, < 2.8.11.5 | 2.8.11.5 |
| GHSA-4w82-r329-3q67 Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 26.59% |
>= 2.7.0, < 2.7.9.7 | 2.7.9.7 |
| GHSA-gww7-p5w4-wrfv Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 8.64% |
>= 2.8.0, < 2.8.11.5 | 2.8.11.5 |
| GHSA-gww7-p5w4-wrfv Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 8.64% |
>= 2.9.0, < 2.9.10.2 | 2.9.10.2 |
| GHSA-gww7-p5w4-wrfv Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 8.64% |
>= 2.7.0, < 2.7.9.7 | 2.7.9.7 |
| GHSA-gww7-p5w4-wrfv Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 8.64% |
>= 2.0.0, < 2.6.7.4 | 2.6.7.4 |
| GHSA-gjmw-vf9h-g25v jackson-databind polymorphic typing issue |
Critical EPSS 5.37% |
< 2.6.7.3 | 2.6.7.3 |
| GHSA-gjmw-vf9h-g25v jackson-databind polymorphic typing issue |
Critical EPSS 5.37% |
>= 2.9.0, < 2.9.10.1 | 2.9.10.1 |
| GHSA-gjmw-vf9h-g25v jackson-databind polymorphic typing issue |
Critical EPSS 5.37% |
>= 2.7.0, < 2.8.11.5 | 2.8.11.5 |
| GHSA-fmmc-742q-jg75 jackson-databind polymorphic typing issue |
Critical EPSS 4.74% |
>= 2.9.0, < 2.9.10.1 | 2.9.10.1 |
| GHSA-fmmc-742q-jg75 jackson-databind polymorphic typing issue |
Critical EPSS 4.74% |
< 2.6.7.3 | 2.6.7.3 |
| GHSA-fmmc-742q-jg75 jackson-databind polymorphic typing issue |
Critical EPSS 4.74% |
>= 2.7.0, < 2.8.11.5 | 2.8.11.5 |
| GHSA-mx7p-6679-8g3q Polymorphic Typing in FasterXML jackson-databind |
Critical EPSS 5.73% |
>= 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| GHSA-mx7p-6679-8g3q Polymorphic Typing in FasterXML jackson-databind |
Critical EPSS 5.73% |
>= 2.9.0, < 2.9.10.1 | 2.9.10.1 |
| GHSA-mx7p-6679-8g3q Polymorphic Typing in FasterXML jackson-databind |
Critical EPSS 5.73% |
>= 2.7.0, < 2.8.11.5 | 2.8.11.5 |
| GHSA-85cw-hj65-qqv9 Polymorphic Typing issue in FasterXML jackson-databind |
Critical EPSS 4.92% |
< 2.6.7.3 | 2.6.7.3 |
| GHSA-85cw-hj65-qqv9 Polymorphic Typing issue in FasterXML jackson-databind |
Critical EPSS 4.92% |
>= 2.9.0, < 2.9.10 | 2.9.10 |
| GHSA-85cw-hj65-qqv9 Polymorphic Typing issue in FasterXML jackson-databind |
Critical EPSS 4.92% |
>= 2.7.0, < 2.8.11.5 | 2.8.11.5 |
| GHSA-h822-r4r5-v8jg Polymorphic Typing issue in FasterXML jackson-databind |
Critical EPSS 10.76% |
>= 2.9.0, < 2.9.10 | 2.9.10 |
| GHSA-h822-r4r5-v8jg Polymorphic Typing issue in FasterXML jackson-databind |
Critical EPSS 10.76% |
>= 2.7.0, < 2.8.11.5 | 2.8.11.5 |
| GHSA-h822-r4r5-v8jg Polymorphic Typing issue in FasterXML jackson-databind |
Critical EPSS 10.76% |
< 2.6.7.3 | 2.6.7.3 |
| GHSA-gwp4-hfv6-p7hw Deserialization of untrusted data in FasterXML jackson-databind |
High EPSS 10.85% |
>= 2.7.0, < 2.7.9.6 | 2.7.9.6 |
| GHSA-gwp4-hfv6-p7hw Deserialization of untrusted data in FasterXML jackson-databind |
High EPSS 10.85% |
>= 2.9.0, < 2.9.9.2 | 2.9.9.2 |
| GHSA-gwp4-hfv6-p7hw Deserialization of untrusted data in FasterXML jackson-databind |
High EPSS 10.85% |
>= 2.8.0, < 2.8.11.4 | 2.8.11.4 |
| GHSA-gwp4-hfv6-p7hw Deserialization of untrusted data in FasterXML jackson-databind |
High EPSS 10.85% |
< 2.6.7.3 | 2.6.7.3 |
| GHSA-6fpp-rgj9-8rwc Deserialization of untrusted data in FasterXML jackson-databind |
Critical EPSS 8.11% |
< 2.7.9.6 | 2.7.9.6 |
| GHSA-6fpp-rgj9-8rwc Deserialization of untrusted data in FasterXML jackson-databind |
Critical EPSS 8.11% |
>= 2.8.0, < 2.8.11.4 | 2.8.11.4 |
| GHSA-6fpp-rgj9-8rwc Deserialization of untrusted data in FasterXML jackson-databind |
Critical EPSS 8.11% |
>= 2.9.0, < 2.9.9.2 | 2.9.9.2 |
| GHSA-cmfg-87vq-g5g4 Deserialization of untrusted data in FasterXML jackson-databind |
Medium EPSS 10.90% |
>= 2.9.0, < 2.9.9.1 | 2.9.9.1 |
| GHSA-cmfg-87vq-g5g4 Deserialization of untrusted data in FasterXML jackson-databind |
Medium EPSS 10.90% |
>= 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| GHSA-cmfg-87vq-g5g4 Deserialization of untrusted data in FasterXML jackson-databind |
Medium EPSS 10.90% |
>= 2.7.0, < 2.7.9.6 | 2.7.9.6 |
| GHSA-cmfg-87vq-g5g4 Deserialization of untrusted data in FasterXML jackson-databind |
Medium EPSS 10.90% |
>= 2.8.0, < 2.8.11.4 | 2.8.11.4 |
| GHSA-qr7j-h6gg-jmgc Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 5.73% |
>= 2.8.0, < 2.8.11.2 | 2.8.11.2 |
| GHSA-qr7j-h6gg-jmgc Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 5.73% |
>= 2.0.0, < 2.7.9.4 | 2.7.9.4 |
| GHSA-qr7j-h6gg-jmgc Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 5.73% |
>= 2.9.0, < 2.9.6 | 2.9.6 |
| GHSA-mph4-vhrx-mv67 Deserialization of Untrusted Data in FasterXML jackson-databind |
Medium EPSS 45.20% |
>= 2.8.0, < 2.8.11.4 | 2.8.11.4 |
| GHSA-mph4-vhrx-mv67 Deserialization of Untrusted Data in FasterXML jackson-databind |
Medium EPSS 45.20% |
>= 2.9.0, < 2.9.9.1 | 2.9.9.1 |
| GHSA-mph4-vhrx-mv67 Deserialization of Untrusted Data in FasterXML jackson-databind |
Medium EPSS 45.20% |
>= 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| GHSA-mph4-vhrx-mv67 Deserialization of Untrusted Data in FasterXML jackson-databind |
Medium EPSS 45.20% |
>= 2.7.0, < 2.7.9.6 | 2.7.9.6 |
| GHSA-5ww9-j83m-q7qx Information exposure in FasterXML jackson-databind |
High EPSS 21.95% |
>= 2.9.0, < 2.9.9 | 2.9.9 |
| GHSA-5ww9-j83m-q7qx Information exposure in FasterXML jackson-databind |
High EPSS 21.95% |
>= 2.8.0, < 2.8.11.4 | 2.8.11.4 |
| GHSA-5ww9-j83m-q7qx Information exposure in FasterXML jackson-databind |
High EPSS 21.95% |
>= 2.7.0, < 2.7.9.6 | 2.7.9.6 |
| GHSA-5ww9-j83m-q7qx Information exposure in FasterXML jackson-databind |
High EPSS 21.95% |
>= 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| GHSA-cjjf-94ff-43w7 jackson-databind Deserialization of Untrusted Data vulnerability |
High EPSS 7.29% |
< 2.7.9.4 | 2.7.9.4 |
| GHSA-cjjf-94ff-43w7 jackson-databind Deserialization of Untrusted Data vulnerability |
High EPSS 7.29% |
>= 2.8.0, < 2.8.11.2 | 2.8.11.2 |
| GHSA-cjjf-94ff-43w7 jackson-databind Deserialization of Untrusted Data vulnerability |
High EPSS 7.29% |
>= 2.9.0, < 2.9.6 | 2.9.6 |
| GHSA-4gq5-ch57-c2mg Arbitrary Code Execution in jackson-databind |
Critical EPSS 9.68% |
>= 2.9.0, < 2.9.7 | 2.9.7 |
| GHSA-4gq5-ch57-c2mg Arbitrary Code Execution in jackson-databind |
Critical EPSS 9.68% |
>= 2.0.0, < 2.7.9.5 | 2.7.9.5 |
| GHSA-4gq5-ch57-c2mg Arbitrary Code Execution in jackson-databind |
Critical EPSS 9.68% |
>= 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| GHSA-x2w5-5m2g-7h5m XML External Entity Reference (XXE) in jackson-databind |
Critical EPSS 7.52% |
>= 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| GHSA-x2w5-5m2g-7h5m XML External Entity Reference (XXE) in jackson-databind |
Critical EPSS 7.52% |
>= 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| GHSA-x2w5-5m2g-7h5m XML External Entity Reference (XXE) in jackson-databind |
Critical EPSS 7.52% |
>= 2.9.0, < 2.9.7 | 2.9.7 |
| GHSA-9mxf-g3x6-wv74 Server-Side Request Forgery (SSRF) in jackson-databind |
Critical EPSS 10.46% |
>= 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| GHSA-9mxf-g3x6-wv74 Server-Side Request Forgery (SSRF) in jackson-databind |
Critical EPSS 10.46% |
>= 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| GHSA-9mxf-g3x6-wv74 Server-Side Request Forgery (SSRF) in jackson-databind |
Critical EPSS 10.46% |
>= 2.9.0, < 2.9.7 | 2.9.7 |
| GHSA-c8hm-7hpq-7jhg com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data |
Critical EPSS 10.60% |
>= 2.9.0, < 2.9.8 | 2.9.8 |
| GHSA-c8hm-7hpq-7jhg com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data |
Critical EPSS 10.60% |
>= 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| GHSA-c8hm-7hpq-7jhg com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data |
Critical EPSS 10.60% |
>= 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| GHSA-c8hm-7hpq-7jhg com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data |
Critical EPSS 10.60% |
>= 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| GHSA-mx9v-gmh4-mgqw Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 10.60% |
>= 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| GHSA-mx9v-gmh4-mgqw Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 10.60% |
>= 2.9.0, < 2.9.8 | 2.9.8 |
| GHSA-mx9v-gmh4-mgqw Deserialization of Untrusted Data in jackson-databind |
Critical EPSS 10.60% |
>= 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| GHSA-f9hv-mg5h-xcw9 Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization |
Critical EPSS 10.60% |
>= 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| GHSA-f9hv-mg5h-xcw9 Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization |
Critical EPSS 10.60% |
>= 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| GHSA-f9hv-mg5h-xcw9 Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization |
Critical EPSS 10.60% |
>= 2.9.0, < 2.9.8 | 2.9.8 |
| GHSA-645p-88qh-w398 Arbitrary Code Execution in jackson-databind |
Critical EPSS 12.68% |
>= 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| GHSA-645p-88qh-w398 Arbitrary Code Execution in jackson-databind |
Critical EPSS 12.68% |
>= 2.9.0, < 2.9.7 | 2.9.7 |
| GHSA-645p-88qh-w398 Arbitrary Code Execution in jackson-databind |
Critical EPSS 12.68% |
>= 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| GHSA-645p-88qh-w398 Arbitrary Code Execution in jackson-databind |
Critical EPSS 12.68% |
>= 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| GHSA-rfx6-vp9g-rh7v jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass |
Critical EPSS 49.73% |
>= 2.8.0, < 2.8.11 | 2.8.11 |
| GHSA-rfx6-vp9g-rh7v jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass |
Critical EPSS 49.73% |
< 2.7.9.2 | 2.7.9.2 |
| GHSA-rfx6-vp9g-rh7v jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass |
Critical EPSS 49.73% |
>= 2.9.0, < 2.9.4 | 2.9.4 |
| GHSA-h592-38cm-4ggp jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution |
Critical EPSS 8.36% |
>= 2.7.0, < 2.7.9.2 | 2.7.9.2 |
| GHSA-h592-38cm-4ggp jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution |
Critical EPSS 8.36% |
>= 2.9.0, < 2.9.4 | 2.9.4 |
| GHSA-h592-38cm-4ggp jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution |
Critical EPSS 8.36% |
>= 2.8.0, < 2.8.11 | 2.8.11 |
| GHSA-h592-38cm-4ggp jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution |
Critical EPSS 8.36% |
>= 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| GHSA-cggj-fvv3-cqwv FasterXML jackson-databind allows unauthenticated remote code execution |
Critical EPSS 19.78% |
< 2.6.7.5 | 2.6.7.5 |
| GHSA-cggj-fvv3-cqwv FasterXML jackson-databind allows unauthenticated remote code execution |
Critical EPSS 19.78% |
>= 2.7.0, < 2.7.9.3 | 2.7.9.3 |
| GHSA-cggj-fvv3-cqwv FasterXML jackson-databind allows unauthenticated remote code execution |
Critical EPSS 19.78% |
>= 2.9.0, < 2.9.5 | 2.9.5 |
| GHSA-cggj-fvv3-cqwv FasterXML jackson-databind allows unauthenticated remote code execution |
Critical EPSS 19.78% |
>= 2.8.0, < 2.8.11.1 | 2.8.11.1 |
| GHSA-qxxx-2pp7-5hmx jackson-databind is vulnerable to a deserialization flaw |
Critical EPSS 37.72% |
>= 2.8.0, < 2.8.9 | 2.8.9 |
| GHSA-qxxx-2pp7-5hmx jackson-databind is vulnerable to a deserialization flaw |
Critical EPSS 37.72% |
< 2.6.7.1 | 2.6.7.1 |
| GHSA-qxxx-2pp7-5hmx jackson-databind is vulnerable to a deserialization flaw |
Critical EPSS 37.72% |
>= 2.7.0, < 2.7.9.1 | 2.7.9.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor