com.fasterxml.jackson.core:jackson-databind vulnerabilities
CVEs whose affected-version data names the com.fasterxml.jackson.core:jackson-databind package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-68497High· 7.5PoCjackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLD…
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLD…
▾ MidnightFasterXML · com.fasterxml.jackson.core:jackson-databindEPSS 0.58%via NVD
GHSA-mhm7-754m-9p8wMedium· 6.5jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`
jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`
▾ Sunlitfasterxml · com.fasterxml.jackson.core:jackson-databindvia GHSA