F
Vendor security profile
fasterxml
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs72
Critical17
CISA KEV0
Public exploit29
Patch rate%93
Avg. CVSS8.2
12-month vulnerability rate
0
0
0
0
1
0
0
2
0
3
7
2
CVE KEV
CVE severity distribution
72toplam CVE
Critical17 (24%)
High49 (68%)
Medium6 (8%)
Patch and exploitation view
%93
Verified patch
%0
CISA KEV
%40
Public exploit
66Patch available
1Partial
0Workaround
0Vendor: no patch
5Unknown
Latest vulnerabilities
7.5
CVE-2026-68496
jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
F
Patch verifiedEPSS %1
7.5
CVE-2026-68495
jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
F
Patch verifiedEPSS %1
7.5
CVE-2026-91777
jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
F
Patch verifiedEPSS %0
7.5
CVE-2026-91776
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
F
Patch verifiedEPSS %0
7.5
CVE-2026-89425
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth
F
Patch verifiedEPSS %0
7.5
CVE-2026-89407
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
F
Patch verifiedEPSS %1
7.5
CVE-2026-68497
jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
F
Patch verifiedEPSS %1
5.6
CVE-2026-83557
jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
F
Patch verifiedEPSS %1
5.3
CVE-2026-19032
jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
F
Patch verifiedEPSS %1
5.3
CVE-2026-77310
jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
F
Patch status unknownEPSS %0