tools.jackson.core:jackson-databind (Maven)
Advisories
23
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.2.3 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.2.3</version></dependency>gradle
implementation("tools.jackson.core:jackson-databind:3.2.3")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-cxp5-3px4-pw24 jackson-databind quadratic forward-reference completion |
High EPSS 0.49% |
>= 3.0.0, < 3.1.7 | 3.1.7 |
| GHSA-cxp5-3px4-pw24 jackson-databind quadratic forward-reference completion |
High EPSS 0.49% |
>= 3.2.0, < 3.2.3 | 3.2.3 |
| GHSA-wv8q-qhhj-9h54 jackson-databind retains every unknown raw type ID |
High EPSS 0.49% |
>= 3.2.0, < 3.2.3 | 3.2.3 |
| GHSA-wv8q-qhhj-9h54 jackson-databind retains every unknown raw type ID |
High EPSS 0.49% |
>= 3.0.0, < 3.1.7 | 3.1.7 |
| GHSA-q4xh-88c3-wmh7 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS |
High EPSS 0.63% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-q4xh-88c3-wmh7 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS |
High EPSS 0.63% |
>= 3.0.0, < 3.1.6 | 3.1.6 |
| GHSA-gx83-3vf8-gh7j jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) |
Medium EPSS 0.72% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-gx83-3vf8-gh7j jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) |
Medium EPSS 0.72% |
>= 3.0.0, < 3.1.6 | 3.1.6 |
| GHSA-wjgm-6hv5-3cvf jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution |
Medium EPSS 0.57% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-wjgm-6hv5-3cvf jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution |
Medium EPSS 0.57% |
>= 3.0.0, < 3.1.6 | 3.1.6 |
| GHSA-vvgp-rfg2-7rr6 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization |
Medium EPSS 0.31% |
>= 3.2.0, < 3.2.1 | 3.2.1 |
| GHSA-vvgp-rfg2-7rr6 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization |
Medium EPSS 0.31% |
>= 3.0.0, < 3.1.5 | 3.1.5 |
| GHSA-5gvw-p9qm-jgwh jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization |
Medium EPSS 0.35% |
>= 3.0.0, < 3.1.5 | 3.1.5 |
| GHSA-5gvw-p9qm-jgwh jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization |
Medium EPSS 0.35% |
>= 3.2.0, < 3.2.1 | 3.2.1 |
| GHSA-3pjw-73gf-8qr5 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy |
Medium EPSS 0.42% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-5hh8-q8hv-fr38 jackson-databind has @JsonView bypass for setterless creator properties |
Medium EPSS 0.38% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-9fxm-vc8v-hj55 jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields |
Medium EPSS 0.45% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-5jmj-h7xm-6q6v jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties |
Medium EPSS 0.44% |
>= 3.1.0, < 3.1.4 | 3.1.4 |
| GHSA-hgj6-7826-r7m5 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) |
Medium EPSS 0.37% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-hgj6-7826-r7m5 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) |
Medium EPSS 0.37% |
>= 2.19.0, < 2.21.4 | 2.21.4 |
| GHSA-rmj7-2vxq-3g9f jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) |
High EPSS 1.23% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-j3rv-43j4-c7qm jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation |
High EPSS 1.20% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
| GHSA-rcqc-6cw3-h962 jackson-databind has a @JsonView bypass for unwrapped creator parameters |
Medium EPSS 0.35% |
>= 3.0.0, < 3.1.4 | 3.1.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor