By vendor

Fasterxml vulnerabilities

Known CVEs affecting Fasterxml products, prioritized by severity, with SEC.co remediation and detection guidance.

8 published vulnerabilities

• CVE-2026-54512HIGH 8.1

  jackson-databind, a widely-used Java library for converting between JSON and Java objects, contains a critical bypass of its built-in polymorphic type validation. When an application deserializes JSON with polymorphic types enabled, attackers can craft a type identifier that includes generic parameters (e.g., ArrayList<EvilClass>) to slip denied classes past the safety check. The validator only checks the outer container type (ArrayList) but ignores what's inside the angle brackets, allowing instantiation and exploitation of restricted classes. This affects versions from 2.10.0 through 2.18.7, 2.21.3, and 3.1.3.

• CVE-2026-54513HIGH 8.1

  Jackson-databind's BasicPolymorphicTypeValidator has a flaw in how it handles array types during deserialization. When a validator is configured to allow array subtypes using the allowIfSubTypeIsArray() method, it checks only that something is an array—not whether the array's contents (the component type) are actually allowed by the allowlist. This means an application that explicitly allows certain safe classes but denies others can still be tricked into deserializing forbidden types if they're wrapped in an array. The vulnerability affects versions from 2.10.0 through several branches and is resolved in patched versions 2.18.8, 2.21.4, and 3.1.4.

• CVE-2026-50193HIGH 7.5

  Jackson-databind, a widely-used Java library for converting JSON to objects and vice versa, has a denial-of-service vulnerability in versions 2.13.0 through 2.13.x. When a service uses the library to read deeply nested JSON structures (thousands of levels deep) and then serializes them back to text, an attacker can exhaust server resources by sending relatively small payloads—for example, 1000 nested arrays consume only 2 kilobytes but trigger expensive processing. The issue is fixed in version 2.14.0 and later.

• CVE-2026-54518MEDIUM 6.5

  Jackson-databind, a widely-used Java library for converting JSON to objects, has a flaw where constructor parameters can be populated with JSON data even when access controls (views) should prevent it. Specifically, when a constructor parameter is marked both @JsonUnwrapped and @JsonView(AdminView.class), the library bypasses the view restriction during JSON deserialization, allowing an attacker to inject data into admin-only fields. This affects versions 2.21.0 through 2.21.3 and 3.1.3, and is patched in 2.21.4 and 3.1.4.

• CVE-2026-54514MEDIUM 5.3

  Jackson-databind, a widely-used Java library for converting JSON to objects, has a DNS leakage vulnerability in versions before 2.18.8, 2.21.4, and 3.1.4. When an application deserializes untrusted JSON containing an InetSocketAddress field, the library performs an immediate DNS lookup on any hostname in that field—before the application has a chance to validate the data or decide whether to connect. This allows an attacker to force your systems to issue DNS queries to attacker-controlled domains, leaking information about what JSON you're processing and potentially enabling DNS-based attacks.

• CVE-2026-54515MEDIUM 5.3

  Jackson-databind, a widely-used Java library for converting JSON to Java objects, has a flaw that allows properties marked to be ignored during deserialization to become writable again in certain configurations. When a developer uses @JsonIgnoreProperties to exclude specific fields from being deserialized, and also enables case-insensitive property matching via @JsonFormat, the library incorrectly rebuilds its property filter from the unfiltered map, reinstating the very properties it should block. An attacker who can supply JSON input to an affected application could write to fields that should be protected, potentially modifying application state or bypassing business logic constraints.

• CVE-2026-54516MEDIUM 5.3

  Jackson-databind, a widely-used Java library for converting JSON to and from objects, has a flaw in how it handles property annotations. The bug allows attackers to write data to fields that should be protected by @JsonIgnore annotations when certain conditions are met. Specifically, if a class uses @JsonProperty to rename a getter but @JsonIgnore on the setter, an attacker can bypass the ignore directive by sending JSON with the renamed key, directly modifying the underlying field. This works because Jackson's property inference logic treats the backing field as writable even though the intended API forbids it. The vulnerability affects versions 2.21.0 through 2.21.4 and 3.1.4 (or earlier in the 3.x line prior to 3.1.4).

• CVE-2026-54517MEDIUM 5.3

  A flaw in Jackson's data-binding library allows attackers to bypass view-based access controls during JSON deserialization. When a JSON API uses @JsonView annotations to hide certain properties from specific clients or roles, this vulnerability can cause hidden collection or map properties to be populated anyway if they lack a setter method. An attacker sending crafted JSON can inject data into fields that should have been invisible, potentially modifying application state in unintended ways.