maven

com.fasterxml.jackson.core:jackson-databind

81 Total advisories

81 Vulnerabilities

0 Malware

Dependency scanning

Check whether com.fasterxml.jackson.core:jackson-databind is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

com.fasterxml.jackson.core:jackson-databind

Vulnerabilities

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

jackson-databind has @JsonView bypass for setterless creator properties

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`

jackson-databind has a @JsonView bypass for unwrapped creator parameters

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

Uncontrolled Resource Consumption in Jackson-databind

Uncontrolled Resource Consumption in FasterXML jackson-databind

Deeply nested json in jackson-databind

Polymorphic Typing issue in FasterXML jackson-databind

Polymorphic deserialization of malicious object in jackson-databind

XML External Entity (XXE) Injection in Jackson Databind

jackson-databind mishandles the interaction between serialization gadgets and typing

Deserialization of untrusted data in Jackson Databind

Deserialization of untrusted data in Jackson Databind

Server-Side Request Forgery (SSRF) in jackson-databind

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind mishandles the interaction between serialization gadgets and typing

Deserialization of untrusted data in Jackson Databind

Deserialization of Untrusted Data

jackson-databind mishandles the interaction between serialization gadgets and typing

Deserialization of Untrusted Data in jackson-databind

Deserialization of untrusted data in Jackson Databind

Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization

jackson-databind mishandles the interaction between serialization gadgets and typing

XML External Entity Reference (XXE) in jackson-databind

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind vulnerable to unsafe deserialization

Unsafe Deserialization in jackson-databind

Deserialization of untrusted data in jackson-databind

Deserialization of Untrusted Data in jackson-databind

jackson-databind mishandles the interaction between serialization gadgets and typing

Serialization gadgets exploit in jackson-databind

jackson-databind polymorphic typing issue

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind polymorphic typing issue

Arbitrary Code Execution in jackson-databind

Deserialization of Untrusted Data in jackson-databind

Improper Input Validation in jackson-databind

Arbitrary Code Execution in jackson-databind

Polymorphic Typing issue in FasterXML jackson-databind

Deserialization of untrusted data in FasterXML jackson-databind

FasterXML jackson-databind allows unauthenticated remote code execution

Deserialization of untrusted data in FasterXML jackson-databind

Information exposure in FasterXML jackson-databind

com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data

jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

Deserialization of Untrusted Data in FasterXML jackson-databind

Deserialization of Untrusted Data in jackson-databind

Polymorphic Typing in FasterXML jackson-databind

jackson-databind mishandles the interaction between serialization gadgets and typing

Serialization gadgets exploit in jackson-databind

Deserialization of untrusted data in FasterXML jackson-databind

Deserialization of Untrusted Data in jackson-databind

jackson-databind is vulnerable to a deserialization flaw

jackson-databind Deserialization of Untrusted Data vulnerability

Deserialization of Untrusted Data in jackson-databind

jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

Serialization gadget exploit in jackson-databind

Unsafe Deserialization in jackson-databind

Unsafe Deserialization in jackson-databind

Polymorphic deserialization of malicious object in jackson-databind

Unsafe Deserialization in jackson-databind

Unsafe Deserialization in jackson-databind

Unsafe Deserialization in jackson-databind

Unsafe Deserialization in jackson-databind

Code Injection in jackson-databind

Unsafe Deserialization in jackson-databind

Unsafe Deserialization in jackson-databind