14
CVEs
1
Critical
10
High
0
KEV
6
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
10
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
Jackson Databind
55
Debian Linux
39
Communications Evolved Communications Application Server
25
Communications Instant Messaging Server
23
Banking Platform
22
Retail Xstore Point Of Service
21
Agile Plm
21
Jd Edwards Enterpriseone Orchestrator
20
Steelstore Cloud Integrated Storage
20
Jd Edwards Enterpriseone Tools
20
Communications Diameter Signaling Router
19
Communications Calendar Server
19
Communications Contacts Server
18
Weblogic Server
18
Retail Merchandising System
18
Primavera Unifier
17
Communications Session Report Manager
17
Communications Element Manager
17
Global Lifecycle Management Opatch
17
Active Iq Unified Manager
16
Autovue For Agile Product Lifecycle Management
16
Communications Session Route Manager
16
Communications Network Charging And Control
15
Retail Sales Audit
14
Banking Digital Experience
13
Enterprise Manager Base Platform
12
Oncommand Workflow Automation
11
Java
11
Financial Services Analytical Applications Infrastructure
11
Service Level Manager
11
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-18401 | Denial of service in FasterXML jackson-core's non-blocking (async) JSON parser allows unauthenticated network attackers to exhaust JVM heap and CPU by submitting JSON containing arbitrarily long number tokens that bypass the maxNumberLength constraint. Affected deployments are those using the async parser API - particularly reactive frameworks such as Spring WebFlux - running com.fasterxml.jackson.core:jackson-core 2.15.0-2.18.5 or 2.19.0-2.21.0, or tools.jackson.core:jackson-core 3.0.0-3.0.x. Publicly available exploit code exists (PoC JUnit test published in GHSA-72hv-8253-57qq); the vulnerability is not listed in the CISA KEV catalog at time of analysis. | MEDIUM | 6.9 | 0.3% | 55 |
PoC
|
| CVE-2026-110879 | Class-name polymorphic deserialization in jackson-databind is insufficiently validated: the outer class in a type ID is checked, but classes named inside generic arguments (and array element types) are accepted even when they would be rejected as direct type IDs, letting an attacker instantiate arbitrary classes. Affected are com.fasterxml.jackson.core:jackson-databind 2.10.0 through 2.18.11, 2.19.0 through 2.21.7 and 2.22.0 through 2.22.3, plus tools.jackson.core:jackson-databind 3.0.0 through 3.1.7 and 3.2.0 through 3.2.3; releases before 2.10.0 are unaffected because PolymorphicTypeValidator did not yet exist, and the earlier CVE-2026-54512 fixes (2.18.8, 2.21.4, 3.1.4) do not remediate this bypass. The default-validator case needs no application-authored validator at all, and the advisory's PoC demonstrates that with Spring on the classpath and attacker-controlled XML, FileSystemXmlApplicationContext is reached through map-key discovery and ProcessBuilder.start() executes arbitrary commands under the application account; the issue carries a public reproducer and warrants the act_now priority label, although exploitation remains gated on the specific polymorphism configuration, available classpath gadgets and a reachable deserialization entry point. | CRITICAL | 9.8 | 1.2% | 50 |
|
| CVE-2026-77310 | DNS-based server-side request forgery in jackson-databind exposes any Java application that deserializes user-supplied JSON into objects containing `java.net.InetAddress`-typed fields, causing the library to perform unsolicited outbound DNS lookups against attacker-controlled hostnames. Affected across all major release lines from 2.x through 3.x (com.fasterxml and tools.jackson.core artifact groups), the flaw allows unauthenticated remote attackers to enumerate internal hostnames and map internal network topology via DNS side-channels. No active exploitation or public exploit code has been identified; vendor patches are available across all affected release lines. | MEDIUM | 5.3 | 0.2% | 47 |
PoC
|
| CVE-2026-68494 | Memory exhaustion in jackson-core's non-blocking async parser allows remote unauthenticated attackers to exhaust JVM heap by streaming JSON integer digit sequences in small chunks without ever sending a terminator byte. The prior fix for GHSA-72hv-8253-57qq (CVE-2026-18401) failed to insert a `validateIntegerLength()` call on the `NOT_AVAILABLE` return path inside `MINOR_NUMBER_INTEGER_DIGITS`, allowing the internal `TextBuffer` accumulator to grow bounded only by `maxStringLength` (20 MiB default) rather than `maxNumberLength` (1000 chars default) - a ~20,000x amplification yielding approximately 40 MiB of heap pressure per connection due to Java's 2-byte char representation. Reactive frameworks that feed inbound HTTP or gRPC bytes incrementally to the async parser - Spring WebFlux/Reactor, Quarkus, Helidon, and Vert.x - are the primary risk surface; no public exploit identified at time of analysis. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-68498 | Heap exhaustion denial of service in FasterXML jackson-core 2.16.0 and later allows an unauthenticated remote attacker to force allocation of roughly 100 MB or more per oversized JSON property name whenever untrusted JSON is parsed from a character-based source (String, Reader, or char[]), which is the normal path for a request body already read into a String. Because the maxNameLength bound (default 50,000 characters, ~100 KB) is only validated after the entire name has been buffered, the much larger maxStringLength bound (default 100,000,000 characters, roughly 200 MB with segment bookkeeping overhead) governs first, and repeating this across concurrent requests can exhaust the heap and crash the process. The impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available. | HIGH | 7.5 | 0.9% | 38 |
|
| CVE-2026-68495 | Memory-exhaustion denial of service in the FasterXML jackson-dataformats-binary CBOR parser allows an unauthenticated remote attacker to force unbounded heap allocation by submitting a CBOR document containing a single property name of arbitrary length; the parser buffers the entire name in memory before returning it because maxNameLength is never validated for this binary format. The defect affects jackson-dataformats-binary running against jackson-core 2.16.0 or later (releases before 2.16.0 never contained the constraint that is left unenforced), and is reachable under default configuration because StreamReadConstraints.maxDocumentLength is disabled by default, leaving no built-in bound on the name. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) there is no confidentiality or integrity impact, and the practical damage ceiling is set by the attacker's upload capacity versus the victim's available heap; no public exploit code was identified at time of analysis, and exploitation requires only that attacker-controlled bytes actually reach CBORFactory or an ObjectMapper configured with the CBOR module. | HIGH | 7.5 | 0.7% | 38 |
|
| CVE-2026-68496 | Memory-exhaustion denial of service in FasterXML jackson-dataformats-binary affects the Smile binary parser on 2.16.0-and-later releases, where SmileParser buffers an entire JSON object property name in memory through an unconstrained _growArrayTo() call inside _handleLongFieldName() and never calls StreamReadConstraints.validateNameLength(), so the configured maxNameLength is silently ignored for this format. Any remote, unauthenticated attacker whose bytes reach SmileFactory parsing - directly or through an ObjectMapper configured with the Smile module - can embed a single unbounded property name and force heap exhaustion, because maxDocumentLength is also disabled by default (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact), leaving upload capacity and available heap as the only practical limits. No public exploit identified at time of analysis, and applications that parse only standard JSON are unaffected since jackson-core's JSON parsers enforce maxNameLength incrementally during name decoding. | HIGH | 7.5 | 0.7% | 38 |
|
| CVE-2026-68497 | Uncontrolled resource consumption in jackson-databind's CoreXMLDeserializers allows unauthenticated remote attackers to trigger multi-minute CPU saturation via a single oversized HTTP request. When jackson-databind deserializes a JSON string into a javax.xml.datatype.Duration or XMLGregorianCalendar field, it passes the raw string directly to JDK's DatatypeFactory, which internally calls BigInteger(String) and BigDecimal(String) constructors that exhibit O(n²) time complexity relative to digit count. Because the malicious digits are embedded in a JSON string token rather than a JSON number token, jackson-core's existing StreamReadConstraints.maxNumberLength guard is bypassed entirely. A few megabytes of input containing millions of digits can consume tens of seconds to minutes of CPU, and a handful of concurrent such requests can exhaust a server's worker thread pool. No public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.6% | 38 |
PoC
|
| CVE-2026-89425 | Denial of service in FasterXML jackson-core 2.8.0 and later: an unauthenticated remote attacker who can supply a malformed JSON token to a parser created via JsonFactory.createParser(DataInput) causes UTF8DataInputJsonParser._reportInvalidToken() to accumulate the entire offending token into an exception message without ever applying ErrorReportConfiguration.getMaxErrorTokenLength(). The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token (versus 367 characters for identical input on the InputStream path), and because the StringBuilder also incurs byte-to-char expansion and internal array doubling, scaling the payload can exhaust heap and trigger a JVM-wide OutOfMemoryError. Only the DataInput parser path is reachable, impact is availability-only, and no public exploit identified at time of analysis; the 7.5 base score captures the theoretical worst case rather than the narrow real-world reachability. | HIGH | 7.5 | 0.5% | 38 |
|
| CVE-2026-91776 | Memory exhaustion in FasterXML jackson-databind allows unauthenticated remote attackers to grow an internal deserializer cache without bound by submitting JSON payloads that carry ever-changing, unrecognized polymorphic type IDs. TypeDeserializerBase caches each fallback resolution keyed by the raw attacker-supplied ID string, the map has no configurable size limit, and it lives for the lifetime of the long-lived ObjectMapper, so distinct unknown IDs translate directly into permanently retained heap - the reporter measured 10,000 retained entries from 10,000 distinct unknown IDs versus a single entry for 10,000 repetitions of one unknown ID. Exploitation requires a non-default configuration (name-based polymorphism via @JsonTypeInfo(use = Id.NAME) with a defaultImpl/fallback deserializer, an endpoint that accepts attacker-influenced type IDs, and a shared application-scoped mapper), so the affected population is substantially narrower than the 7.5 base score suggests; no public exploit has been identified at time of analysis and a vendor patch is available. | HIGH | 7.5 | 0.5% | 38 |
PoC
|
| CVE-2026-91777 | Denial of service in FasterXML jackson-databind allows unauthenticated remote attackers to exhaust CPU resources by submitting crafted JSON that triggers quadratic complexity in forward-reference resolution for @JsonIdentityInfo object IDs. The attack requires the application to deserialize attacker-influenced JSON into a collection or map configured with @JsonIdentityInfo; a shallow document with N forward references defined in reverse order causes O(N^2) identity comparisons during deserialization. This is a conditional availability risk-only applications using identity-enabled deserialization on untrusted input are exposed-and no public exploit code has been identified at time of analysis, though a vendor patch is available. | HIGH | 7.5 | 0.5% | 38 |
PoC
|
| CVE-2026-110747 | Denial of service in jackson-dataformat-protobuf (2.21.6-2.21.7, 2.22.0-2.22.3, 3.1.6-3.1.7 and 3.2.2-3.2.3) lets an 8-byte malformed protobuf message force an oversized buffer allocation that ends in OutOfMemoryError, so any application that streaming-parses untrusted protobuf against a schema containing a string-keyed map (map<string, V>) is exposed. The overflow occurs in ProtobufParser._readStringKey(), where a declared key length of 0x7FFFFFFF wraps the signed bounds check and reaches TextBuffer.expandCurrentSegment(); StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not block it, and JVMs started with -XX:+ExitOnOutOfMemoryError terminate outright (observed exit code 3). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), consistent with pure availability impact and no demonstrated confidentiality or integrity effect; a working proof-of-concept payload is documented in the vendor advisory, but there is no CISA KEV listing and no confirmed active exploitation, and the vuln.today decision label places remediation in this week's queue. | HIGH | 7.5 | 0.4% | 38 |
|
| CVE-2026-104895 | Eager, unbounded memory allocation in the asynchronous Smile parser (NonBlockingByteArrayParser) lets a Smile feed of roughly ten bytes force a byte[] allocation of approximately 2 GB before any body bytes are consumed, producing an OutOfMemoryError that crashes the request or processing thread on reactive/async Smile endpoints; a VInt crafted to overflow int instead yields a negative length and a NegativeArraySizeException that is not a JacksonException and so escapes the parser contract. Only applications that construct the non-blocking parser via SmileFactory.createNonBlockingByteArrayParser and feed it attacker-supplied Smile bytes are exposed - the blocking SmileParser already contains the (value >>> 25) overflow guard - and no authentication, privileges or user interaction are required beyond the ability to submit data for parsing (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-789). No public exploit code has been identified at time of analysis, although the upstream advisory includes a code-verified reproduction recipe, and fixes are published across all supported branches. | HIGH | 7.5 | 0.4% | 38 |
|
| CVE-2026-19032 | jackson-databind's NioPathDeserializer passes attacker-controlled URI strings from untrusted JSON through an unrestricted URI scheme resolution pipeline, allowing selection and invocation of arbitrary registered FileSystemProvider implementations at deserialization time. Affected versions span com.fasterxml.jackson.core:jackson-databind 2.8.0 through the pre-2.18.10/2.21.6/2.22.2 ranges and tools.jackson.core:jackson-databind 3.0.0 through the pre-3.1.6/3.2.2 ranges. With only JDK built-in providers present the immediate impact is a limited availability concern; with third-party FileSystemProviders such as S3 or HDFS adapters on the classpath, attackers can trigger side-effecting provider operations via crafted JSON fields. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV. | MEDIUM | 5.3 | 0.5% | 27 |
PoC
|