24
CVEs
1
Critical
13
High
0
KEV
8
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
13
MEDIUM
10
LOW
0
Monthly CVE Trend
Affected Products (30)
Jackson Databind
55
Debian Linux
39
Communications Evolved Communications Application Server
25
Communications Instant Messaging Server
23
Banking Platform
22
Retail Xstore Point Of Service
21
Agile Plm
21
Jd Edwards Enterpriseone Orchestrator
20
Steelstore Cloud Integrated Storage
20
Jd Edwards Enterpriseone Tools
20
Communications Diameter Signaling Router
19
Communications Calendar Server
19
Communications Contacts Server
18
Weblogic Server
18
Retail Merchandising System
18
Primavera Unifier
17
Communications Session Report Manager
17
Communications Element Manager
17
Global Lifecycle Management Opatch
17
Active Iq Unified Manager
16
Autovue For Agile Product Lifecycle Management
16
Communications Session Route Manager
16
Communications Network Charging And Control
15
Retail Sales Audit
14
Banking Digital Experience
13
Enterprise Manager Base Platform
12
Oncommand Workflow Automation
11
Java
11
Financial Services Analytical Applications Infrastructure
11
Service Level Manager
11
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-54512 | PolymorphicTypeValidator bypass in jackson-databind versions 2.10.0 through 2.18.7, 2.19.0 through 2.21.3, and 3.0.0 through 3.1.3 allows attackers controlling JSON type identifiers to smuggle denied gadget classes through allow-listed generic containers, leading to arbitrary class instantiation and potential remote code execution. The flaw stems from DatabindContext._resolveAndValidateGeneric() validating only the raw container class name while skipping all nested generic type arguments. No public exploit identified at time of analysis, but the GHSA advisory includes a proof-of-concept configuration and payload structure. | HIGH | 8.1 | 0.6% | 61 |
PoC
|
| CVE-2026-18401 | Denial of service in FasterXML jackson-core's non-blocking (async) JSON parser allows unauthenticated network attackers to exhaust JVM heap and CPU by submitting JSON containing arbitrarily long number tokens that bypass the maxNumberLength constraint. Affected deployments are those using the async parser API - particularly reactive frameworks such as Spring WebFlux - running com.fasterxml.jackson.core:jackson-core 2.15.0-2.18.5 or 2.19.0-2.21.0, or tools.jackson.core:jackson-core 3.0.0-3.0.x. Publicly available exploit code exists (PoC JUnit test published in GHSA-72hv-8253-57qq); the vulnerability is not listed in the CISA KEV catalog at time of analysis. | MEDIUM | 6.9 | 0.3% | 55 |
PoC
|
| CVE-2026-59889 | jackson-databind's @JsonView authorization guard is bypassable on deserialization when a property carries both @JsonView and @JsonUnwrapped annotations, allowing an authenticated or unauthenticated attacker to mass-assign privileged fields through a less-privileged active view. Affected are com.fasterxml.jackson.core:jackson-databind 2.18.0-2.18.8, 2.21.0-2.21.4, 2.22.0, and tools.jackson.core:jackson-databind 3.0.0-3.1.4, 3.2.0. A publicly available proof-of-concept demonstrates the bypass; SSVC reports no confirmed active exploitation at time of analysis, and EPSS sits at 0.42% (34th percentile), indicating low current threat velocity despite the high-integrity impact. | MEDIUM | 6.5 | 0.4% | 53 |
PoC
|
| CVE-2026-110879 | Class-name polymorphic deserialization in jackson-databind is insufficiently validated: the outer class in a type ID is checked, but classes named inside generic arguments (and array element types) are accepted even when they would be rejected as direct type IDs, letting an attacker instantiate arbitrary classes. Affected are com.fasterxml.jackson.core:jackson-databind 2.10.0 through 2.18.11, 2.19.0 through 2.21.7 and 2.22.0 through 2.22.3, plus tools.jackson.core:jackson-databind 3.0.0 through 3.1.7 and 3.2.0 through 3.2.3; releases before 2.10.0 are unaffected because PolymorphicTypeValidator did not yet exist, and the earlier CVE-2026-54512 fixes (2.18.8, 2.21.4, 3.1.4) do not remediate this bypass. The default-validator case needs no application-authored validator at all, and the advisory's PoC demonstrates that with Spring on the classpath and attacker-controlled XML, FileSystemXmlApplicationContext is reached through map-key discovery and ProcessBuilder.start() executes arbitrary commands under the application account; the issue carries a public reproducer and warrants the act_now priority label, although exploitation remains gated on the specific polymorphism configuration, available classpath gadgets and a reachable deserialization entry point. | CRITICAL | 9.8 | 1.2% | 50 |
|
| CVE-2026-77310 | DNS-based server-side request forgery in jackson-databind exposes any Java application that deserializes user-supplied JSON into objects containing `java.net.InetAddress`-typed fields, causing the library to perform unsolicited outbound DNS lookups against attacker-controlled hostnames. Affected across all major release lines from 2.x through 3.x (com.fasterxml and tools.jackson.core artifact groups), the flaw allows unauthenticated remote attackers to enumerate internal hostnames and map internal network topology via DNS side-channels. No active exploitation or public exploit code has been identified; vendor patches are available across all affected release lines. | MEDIUM | 5.3 | 0.2% | 47 |
PoC
|
| CVE-2026-68494 | Memory exhaustion in jackson-core's non-blocking async parser allows remote unauthenticated attackers to exhaust JVM heap by streaming JSON integer digit sequences in small chunks without ever sending a terminator byte. The prior fix for GHSA-72hv-8253-57qq (CVE-2026-18401) failed to insert a `validateIntegerLength()` call on the `NOT_AVAILABLE` return path inside `MINOR_NUMBER_INTEGER_DIGITS`, allowing the internal `TextBuffer` accumulator to grow bounded only by `maxStringLength` (20 MiB default) rather than `maxNumberLength` (1000 chars default) - a ~20,000x amplification yielding approximately 40 MiB of heap pressure per connection due to Java's 2-byte char representation. Reactive frameworks that feed inbound HTTP or gRPC bytes incrementally to the async parser - Spring WebFlux/Reactor, Quarkus, Helidon, and Vert.x - are the primary risk surface; no public exploit identified at time of analysis. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-29062 | Uncontrolled-recursion denial of service in FasterXML jackson-core 3.0.0 through 3.0.x lets a remote attacker crash JSON-processing services by submitting a deeply nested JSON document. The UTF8DataInputJsonParser (DataInput sources) and ReaderBasedJsonParser fail to enforce the StreamReadConstraints maxNestingDepth limit (default 500), so excessive nesting drives a StackOverflowError. No public exploit identified at time of analysis and EPSS is low (0.06%), but the bug is trivially triggerable against any service that parses untrusted JSON with these parsers; fixed in 3.1.0. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-54513 | Allowlist bypass in jackson-databind's BasicPolymorphicTypeValidator (PTV) allows attackers to instantiate non-allowlisted classes by wrapping them in arrays (e.g., EvilType[]), defeating a control intended to block deserialization gadget chains. Affects versions 2.10.0 through 2.18.7, 2.19.0 through 2.21.3, and 3.0.0 through 3.1.3 when applications use allowIfSubTypeIsArray() alongside an explicit concrete-type allowlist. No public exploit identified at time of analysis, but the upstream fix and full root-cause writeup are public on GitHub. | HIGH | 8.1 | 0.6% | 41 |
|
| CVE-2026-68498 | Heap exhaustion denial of service in FasterXML jackson-core 2.16.0 and later allows an unauthenticated remote attacker to force allocation of roughly 100 MB or more per oversized JSON property name whenever untrusted JSON is parsed from a character-based source (String, Reader, or char[]), which is the normal path for a request body already read into a String. Because the maxNameLength bound (default 50,000 characters, ~100 KB) is only validated after the entire name has been buffered, the much larger maxStringLength bound (default 100,000,000 characters, roughly 200 MB with segment bookkeeping overhead) governs first, and repeating this across concurrent requests can exhaust the heap and crash the process. The impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available. | HIGH | 7.5 | 0.9% | 38 |
|
| CVE-2026-68495 | Memory-exhaustion denial of service in the FasterXML jackson-dataformats-binary CBOR parser allows an unauthenticated remote attacker to force unbounded heap allocation by submitting a CBOR document containing a single property name of arbitrary length; the parser buffers the entire name in memory before returning it because maxNameLength is never validated for this binary format. The defect affects jackson-dataformats-binary running against jackson-core 2.16.0 or later (releases before 2.16.0 never contained the constraint that is left unenforced), and is reachable under default configuration because StreamReadConstraints.maxDocumentLength is disabled by default, leaving no built-in bound on the name. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) there is no confidentiality or integrity impact, and the practical damage ceiling is set by the attacker's upload capacity versus the victim's available heap; no public exploit code was identified at time of analysis, and exploitation requires only that attacker-controlled bytes actually reach CBORFactory or an ObjectMapper configured with the CBOR module. | HIGH | 7.5 | 0.7% | 38 |
|
| CVE-2026-68496 | Memory-exhaustion denial of service in FasterXML jackson-dataformats-binary affects the Smile binary parser on 2.16.0-and-later releases, where SmileParser buffers an entire JSON object property name in memory through an unconstrained _growArrayTo() call inside _handleLongFieldName() and never calls StreamReadConstraints.validateNameLength(), so the configured maxNameLength is silently ignored for this format. Any remote, unauthenticated attacker whose bytes reach SmileFactory parsing - directly or through an ObjectMapper configured with the Smile module - can embed a single unbounded property name and force heap exhaustion, because maxDocumentLength is also disabled by default (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact), leaving upload capacity and available heap as the only practical limits. No public exploit identified at time of analysis, and applications that parse only standard JSON are unaffected since jackson-core's JSON parsers enforce maxNameLength incrementally during name decoding. | HIGH | 7.5 | 0.7% | 38 |
|
| CVE-2026-68497 | Uncontrolled resource consumption in jackson-databind's CoreXMLDeserializers allows unauthenticated remote attackers to trigger multi-minute CPU saturation via a single oversized HTTP request. When jackson-databind deserializes a JSON string into a javax.xml.datatype.Duration or XMLGregorianCalendar field, it passes the raw string directly to JDK's DatatypeFactory, which internally calls BigInteger(String) and BigDecimal(String) constructors that exhibit O(n²) time complexity relative to digit count. Because the malicious digits are embedded in a JSON string token rather than a JSON number token, jackson-core's existing StreamReadConstraints.maxNumberLength guard is bypassed entirely. A few megabytes of input containing millions of digits can consume tens of seconds to minutes of CPU, and a handful of concurrent such requests can exhaust a server's worker thread pool. No public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.6% | 38 |
PoC
|
| CVE-2026-89425 | Denial of service in FasterXML jackson-core 2.8.0 and later: an unauthenticated remote attacker who can supply a malformed JSON token to a parser created via JsonFactory.createParser(DataInput) causes UTF8DataInputJsonParser._reportInvalidToken() to accumulate the entire offending token into an exception message without ever applying ErrorReportConfiguration.getMaxErrorTokenLength(). The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token (versus 367 characters for identical input on the InputStream path), and because the StringBuilder also incurs byte-to-char expansion and internal array doubling, scaling the payload can exhaust heap and trigger a JVM-wide OutOfMemoryError. Only the DataInput parser path is reachable, impact is availability-only, and no public exploit identified at time of analysis; the 7.5 base score captures the theoretical worst case rather than the narrow real-world reachability. | HIGH | 7.5 | 0.5% | 38 |
|
| CVE-2026-91776 | Memory exhaustion in FasterXML jackson-databind allows unauthenticated remote attackers to grow an internal deserializer cache without bound by submitting JSON payloads that carry ever-changing, unrecognized polymorphic type IDs. TypeDeserializerBase caches each fallback resolution keyed by the raw attacker-supplied ID string, the map has no configurable size limit, and it lives for the lifetime of the long-lived ObjectMapper, so distinct unknown IDs translate directly into permanently retained heap - the reporter measured 10,000 retained entries from 10,000 distinct unknown IDs versus a single entry for 10,000 repetitions of one unknown ID. Exploitation requires a non-default configuration (name-based polymorphism via @JsonTypeInfo(use = Id.NAME) with a defaultImpl/fallback deserializer, an endpoint that accepts attacker-influenced type IDs, and a shared application-scoped mapper), so the affected population is substantially narrower than the 7.5 base score suggests; no public exploit has been identified at time of analysis and a vendor patch is available. | HIGH | 7.5 | 0.5% | 38 |
PoC
|
| CVE-2026-91777 | Denial of service in FasterXML jackson-databind allows unauthenticated remote attackers to exhaust CPU resources by submitting crafted JSON that triggers quadratic complexity in forward-reference resolution for @JsonIdentityInfo object IDs. The attack requires the application to deserialize attacker-influenced JSON into a collection or map configured with @JsonIdentityInfo; a shallow document with N forward references defined in reverse order causes O(N^2) identity comparisons during deserialization. This is a conditional availability risk-only applications using identity-enabled deserialization on untrusted input are exposed-and no public exploit code has been identified at time of analysis, though a vendor patch is available. | HIGH | 7.5 | 0.5% | 38 |
PoC
|