FasterXML
Vulnerability activity for FasterXML: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.5HighOct 28, 2026FasterXML jackson-dataformat-protobuf Memory corruptionCVE-2026-110747ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing O
- 7.5HighOct 28, 2026FasterXML jackson-dataformat-smile Denial of serviceCVE-2026-104895The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can th
- 7.5HighOct 28, 2026FasterXML jackson-dataformat-protobuf Memory corruptionCVE-2026-104016ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMem
- 9.8CriticalOct 28, 2026FasterXML jackson-databind DeserializationCVE-2026-110879jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the typ1.2% likely
- 8.1HighJun 23, 2026FasterXML jackson-databind DeserializationCVE-2026-54512jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic tyExploit code
- 8.1HighJun 23, 2026FasterXML jackson-databindCVE-2026-54513jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating t1.2% likely
- 8.7HighMar 6, 2026FasterXML jackson-core Denial of serviceCVE-2026-29062jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constrain
- 8.7HighJun 25, 2025FasterXML jackson-core Memory corruptionCVE-2025-52999jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsE
- 7.5HighMar 18, 2023Fasterxml jackson-databind Denial of serviceCVE-2021-46877jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.1.1% likely
- 7.5HighOct 2, 2022Fasterxml jackson-databind DeserializationCVE-2022-42004In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.3.4% likely
- 7.5HighOct 2, 2022Fasterxml jackson-databind DeserializationCVE-2022-42003In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.3.4% likely
- 7.5HighMar 11, 2022Fasterxml jackson-databind Memory corruptionCVE-2020-36518jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.4.9% likely
- 7.5HighDec 3, 2020Fasterxml jackson-databindCVE-2020-25649A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.18% likely
Top products
- jackson-databind3 CVEs in the last year, 1 critical
- jackson-dataformat-protobuf2 CVEs in the last year
- jackson-dataformat-smile1 CVE in the last year
- jackson-core1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Atlassian · Sep 15, 2026Atlassian Security Bulletin September 15, 2026CVE-2026-54512CVE-2026-54513
- Atlassian · May 19, 2026Atlassian Security Bulletin May 19, 2026CVE-2026-29062
- Atlassian · Jan 20, 2026Atlassian Security Bulletin January 20, 2026CVE-2025-52999
- Atlassian · Dec 11, 2025Atlassian Security Bulletin December 11, 2025CVE-2020-36518CVE-2021-46877CVE-2025-52999
- Atlassian · Jan 16, 2024Atlassian Security Bulletin January 16, 2024CVE-2020-25649
- Atlassian · Nov 21, 2023Atlassian Security Bulletin November 21, 2023CVE-2020-36518CVE-2021-46877CVE-2022-42003CVE-2022-42004
- Atlassian · Oct 17, 2023Atlassian Security Bulletin October 17, 2023CVE-2020-36518CVE-2021-46877CVE-2022-42003CVE-2022-42004
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.