rpm package
almalinux/pki-jackson-databind
pkg:rpm/almalinux/pki-jackson-databind
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-54513 | Hig | 8.1 | < 2.21.4-1.el9_8 | 2.21.4-1.el9_8 | Jun 23, 2026 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), | |
| CVE-2026-54512 | Hig | 8.1 | < 2.21.4-1.el9_8 | 2.21.4-1.el9_8 | Jun 23, 2026 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. | |
| CVE-2025-52999 | Hig | — | < 2.19.1-1.el9_6 | 2.19.1-1.el9_6 | Jun 25, 2025 | jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the de | |
| CVE-2020-36518 | Hig | 7.5 | < 2.14.1-2.el9 | 2.14.1-2.el9 | Mar 11, 2022 | jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. |
- affected < 2.21.4-1.el9_8fixed 2.21.4-1.el9_8
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(),
- affected < 2.21.4-1.el9_8fixed 2.21.4-1.el9_8
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization.
- affected < 2.19.1-1.el9_6fixed 2.19.1-1.el9_6
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the de
- affected < 2.14.1-2.el9fixed 2.14.1-2.el9
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.