Product by Fasterxml
Jackson
22 known vulnerabilities in Jackson (Fasterxml), 0 of them actively exploited (CISA KEV).
Key figures
22
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-54513 | FasterXML Jackson-databind: Incomplete List of Disallowed Inputs | 8.1 | |
| High | CVE-2026-54512 | FasterXML Jackson-databind: Incomplete List of Disallowed Inputs | 8.1 | |
| High | CVE-2026-104016 | FasterXML Jackson-dataformat-protobuf: Integer Overflow or Wraparound | 7.5 | |
| High | CVE-2025-52999 | FasterXML Jackson-core: Stack-based Buffer Overflow | — | |
| High | CVE-2026-68494 | FasterXML Jackson-core: Allocation of Resources Without Limits or Throttling | — | |
| High | CVE-2026-68496 | FasterXML Jackson-dataformats-binary: Allocation of Resources Without Limits or Throttling | 7.5 | |
| High | CVE-2026-68495 | FasterXML Jackson-dataformats-binary: Allocation of Resources Without Limits or Throttling | 7.5 | |
| High | CVE-2026-89425 | FasterXML Jackson-core: Allocation of Resources Without Limits or Throttling | 7.5 | |
| High | CVE-2026-91777 | jackson-databind: quadratic forward-reference completion in Collection and Map deserializers | 7.5 | |
| High | CVE-2026-91776 | jackson-databind retains every unknown raw type ID | 7.5 | |
| High | CVE-2026-50193 | jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() | 7.5 | |
| High | CVE-2026-110747 | FasterXML Jackson-dataformat-protobuf: Integer Overflow or Wraparound | 7.5 | |
| High | CVE-2026-95155 | FasterXML Jackson: Deserialization of Untrusted Data | 7.5 | |
| Medium | CVE-2026-59888 | jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy | 6.5 | |
| Medium | CVE-2026-77310 | FasterXML Com.fasterxml.jackson.core:jackson-databind: Server-Side Request Forgery (SSRF) | 5.3 | |
| Medium | CVE-2026-59889 | jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization | 6.5 | |
| Medium | CVE-2026-54518 | jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind | 6.5 | |
| Medium | CVE-2026-54516 | jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields | 5.3 | |
| Medium | CVE-2026-54515 | jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties | 5.3 | |
| Medium | CVE-2026-54517 | jackson-databind: @JsonView bypass for setterless creator properties | 5.3 | |
| Medium | CVE-2026-54514 | jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) | 5.3 | |
| Medium | CVE-2025-49128 | Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation | 4.0 |