Fasterxml Jackson-Databind vulnerabilities

CVE-2026-54515 [MEDIUM] CWE-915 CVE-2026-54515: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has

CVE-2023-35116 [MEDIUM] CWE-770 CVE-2023-35116: jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified i jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an ex