Fasterxml vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-110879 jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes vCritical 9.8 · Oct 27, 2026
• CVE-2026-110747 ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <High 7.5 · Oct 27, 2026
• CVE-2026-104895 The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is reHigh 7.5 · Oct 27, 2026
• CVE-2026-104016 ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShoHigh 7.5 · Oct 27, 2026
• CVE-2026-68498 StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being High 7.5 · Oct 16, 2026
• CVE-2026-68496 The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so tHigh 7.5 · Oct 1, 2026
• CVE-2026-68495 The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so thHigh 7.5 · Oct 1, 2026
• CVE-2026-91777 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for everHigh 7.5 · Sep 22, 2026
• CVE-2026-91776 TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID.High 7.5 · Sep 22, 2026
• CVE-2026-89425 UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier charaHigh 7.5 · Sep 22, 2026
• CVE-2026-89407 NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0High 7.5 · Sep 22, 2026
• CVE-2026-68497 jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatHigh 7.5 · Sep 11, 2026
• CVE-2026-68494 The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomHigh 8.7 · Aug 4, 2026
• CVE-2026-54513 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.High 8.1 · Jun 23, 2026
• CVE-2026-54512 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.High 8.1 · Jun 23, 2026
• CVE-2026-29062 jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor.High 8.7 · Mar 6, 2026
• CVE-2025-52999 jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor.High 8.7 · Jun 25, 2025
• CVE-2021-46877 jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read)High 7.5 · Mar 18, 2023
• CVE-2022-42004 In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent useHigh 7.5 · Oct 2, 2022
• CVE-2022-42003 In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializerHigh 7.5 · Oct 2, 2022
• CVE-2020-36518 jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.High 7.5 · Mar 11, 2022
• CVE-2020-28491 This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1.High 7.5 · Feb 18, 2021
• CVE-2021-20190 A flaw was found in jackson-databind before 2.9.10.7.High 8.1 · Jan 19, 2021
• CVE-2020-36183 FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sHigh 8.1 · Jan 6, 2021
• CVE-2020-36182 FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsHigh 8.1 · Jan 6, 2021