Fasterxml - vulnerabilities (CVEs)

107 CVEs in 13 products, 7 in the last 30 days, newest from 2026-10-28.

Products

• Jackson-databind - 78 CVEs
• Jackson-core - 8 CVEs
• Jackson-dataformat-protobuf - 2 CVEs
• Jackson-dataformat-xml - 2 CVEs
• Jackson-dataformats-binary - 2 CVEs
• Com.fasterxml.jackson.corejackson-databind - 1 CVEs
• Jackson-dataformat-smile - 1 CVEs
• Jackson-dataformats-text - 1 CVEs
• Jackson-mapper-asl - 1 CVEs
• Jackson-modules-java8 - 1 CVEs
• Tools.jackson.corejackson-databind - 1 CVEs
• Woodstox - 1 CVEs
• Jackson - 0 CVEs

Newest CVEs of Fasterxml

• CVE-2026-110879 - CVSS 9.8 (critical), 2026-10-28: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes…
• CVE-2026-110747 - CVSS 7.5 (high), 2026-10-28: ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len)…
• CVE-2026-104895 - CVSS 7.5 (high), 2026-10-28: The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is…
• CVE-2026-104016 - CVSS 7.5 (high), 2026-10-27: ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling…
• CVE-2026-68498 - CVSS 7.5 (high), 2026-10-16: StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while…
• CVE-2026-68496 - CVSS 7.5 (high), 2026-10-01: The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so…
• CVE-2026-68495 - CVSS 7.5 (high), 2026-10-01: The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so…
• CVE-2026-91777 - CVSS 7.5 (high), 2026-09-23: Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for…
• CVE-2026-91776 - CVSS 7.5 (high), 2026-09-23: TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When…
• CVE-2026-89425 - CVSS 7.5 (high), 2026-09-23: UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier…
• CVE-2026-89407 - CVSS 7.5 (high), 2026-09-22: NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT…
• CVE-2026-68497 - CVSS 7.5 (high), 2026-09-11: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to…
• CVE-2026-83557 - CVSS 5.6 (medium), 2026-09-01: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom…
• CVE-2026-19032 - CVSS 5.3 (medium), 2026-09-01: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In…
• CVE-2026-77310 - CVSS 5.3 (medium), 2026-08-24: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1,…
• CVE-2026-68494 - CVSS 8.7 (high), 2026-08-04: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is…
• CVE-2026-18401 - CVSS 6.9 (medium), 2026-08-04: The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000…
• CVE-2026-59889 - CVSS 6.5 (medium), 2026-07-14: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1,…
• CVE-2026-59888 - CVSS 6.5 (medium), 2026-07-14: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and…
• CVE-2026-54518 - CVSS 6.5 (medium), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4,…
• CVE-2026-50193 - CVSS 7.5 (high), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential…
• CVE-2026-54512 - CVSS 8.1 (high), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and…
• CVE-2026-54513 - CVSS 8.1 (high), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and…
• CVE-2026-54514 - CVSS 5.3 (medium), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and…
• CVE-2026-54515 - CVSS 5.3 (medium), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and…
• CVE-2026-54516 - CVSS 5.3 (medium), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4,…
• CVE-2026-54517 - CVSS 5.3 (medium), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in…
• CVE-2026-29062 - CVSS 8.7 (high), 2026-03-06: jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before…
• CVE-2025-52999 - CVSS 8.7 (high), 2025-06-25: jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0,…
• CVE-2025-49128 - CVSS 4 (medium), 2025-06-06: Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and…