Fasterxml Jackson-Databind vulnerabilities

CVE-2026-54516 [MEDIUM] CWE-915 CVE-2026-54516: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROP

CVE-2026-54514 [MEDIUM] CWE-918 CVE-2026-54514: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An applica

CVE-2026-54517 [MEDIUM] CWE-863 CVE-2026-54517: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(act

CVE-2026-54515 [MEDIUM] CWE-915 CVE-2026-54515: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has

CVE-2023-35116 [MEDIUM] CWE-770 CVE-2023-35116: jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified i jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an ex