Fasterxml Jackson-Dataformats-Binary vulnerabilities
2 known vulnerabilities affecting fasterxml/jackson-dataformats-binary.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH2
Vulnerabilities
Page 1 of 1
CVE-2026-68495P3HIGHCVSS 7.5≥ 2.16.0, ≤ 2.18.9≥ 2.19.0, ≤ 2.21.5+3 more2026-10-01
CVE-2026-68495 [HIGH] CWE-400 CVE-2026-68495: The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validate
The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser._decodeLongerName() decodes a definite-length property name with no length check, and CBORParser._decodeChunkedName() delegates
nvd
CVE-2020-28491P3HIGHCVSS 7.5fixed in 2.11.4fixed in 2.12.1+1 more2021-02-18
CVE-2020-28491 [HIGH] CWE-770 CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
nvd