How many CVEs have a located fix in FasterXML/jackson-databind?

72 published CVEs have a fix traced to functions in FasterXML/jackson-databind, touching 105 functions across 50 files.

Which function in FasterXML/jackson-databind has been patched by the most CVEs?

checkIllegalTypes in src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java has been changed by 4 CVE fixes, from 2017 to 2018.

How large is a typical CVE fix in FasterXML/jackson-databind?

The median fix changes 11 lines. 67% of fixes change 20 lines or fewer, and 60% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

java

#54 of 500 repositories

FasterXML/jackson-databind

Name: FasterXML/jackson-databind: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 23, 2026

72

CVE fixes located

Published CVEs

105

Functions patched

Distinct function sites

50

Files patched

Distinct source files

2017–2026

Years covered

By CVE publication date

Overview

72 published CVEs have a fix traced to functions in FasterXML/jackson-databind, the earliest published in 2017. Those fixes changed 105 distinct functions across 50 files, in 466 patch hunks.

Among the 500 repositories tracked here, FasterXML/jackson-databind ranks #54 by the number of CVEs with a located fix.

Most patched functions

Functions in FasterXML/jackson-databind changed by the most CVE fixes.

Most patched files

Files in FasterXML/jackson-databind changed by the most CVE fixes.

1src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java48 CVEs · 2 functions
2src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java8 CVEs · 4 functions
3src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java4 CVEs · 2 functions
4src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializer.java3 CVEs · 2 functions
5src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java2 CVEs · 20 functions
6src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java2 CVEs · 7 functions
7src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java2 CVEs · 2 functions
8src/main/java/com/fasterxml/jackson/databind/deser/std/StackTraceElementDeserializer.java2 CVEs · 2 functions
9src/main/java/com/fasterxml/jackson/databind/introspect/POJOPropertiesCollector.java2 CVEs · 2 functions
10src/main/java/tools/jackson/databind/introspect/POJOPropertiesCollector.java2 CVEs · 2 functions

Fix size

How much code a CVE fix in FasterXML/jackson-databind changes, with backports counted once.

11

Median lines changed

Added plus removed, per CVE

67%

Fixes of 20 lines or fewer

Share of CVE fixes

60%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in FasterXML/jackson-databind, and the functions each fix changed.

jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
CVE-2026-91777put add MapReferringAccumulator
High · CVSS 7.5
EPSS 0.4%2026-09-23
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
CVE-2026-91776_findDeserializer cache
High · CVSS 7.5
EPSS 0.4%2026-09-23
jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
CVE-2026-68497_deserialize
High · CVSS 7.5
EPSS 0.6%2026-09-11
jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
CVE-2026-83557UnsafeBaseTypes validateSubType
Medium · CVSS 5.6
EPSS 0.7%2026-09-01
jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
CVE-2026-19032for NioPathHelper NioPathDeserializer
Medium · CVSS 5.3
EPSS 0.5%2026-09-01
jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
CVE-2026-77310literal
Medium · CVSS 5.3
EPSS 0.3%2026-08-24
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
CVE-2026-59889processUnwrapped
Medium · CVSS 6.5
EPSS 0.4%2026-07-14
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
CVE-2026-59888contains
Medium · CVSS 6.5
EPSS 0.4%2026-07-14
jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind
CVE-2026-54518processUnwrappedCreatorProperties
Medium · CVSS 6.5
EPSS 0.4%2026-06-23
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
CVE-2026-50193serializeWithType
Medium · CVSS 6.3
EPSS 0.6%2026-06-23
jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
CVE-2026-54512_resolveAndValidateGeneric validateSubType _appendSubClassMatcher
High · CVSS 8.1
EPSS 1.0%2026-06-23
jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
CVE-2026-54513allowIfSubType validateSubType BasicPolymorphicTypeValidator
High · CVSS 8.1
EPSS 1.2%2026-06-23

Get an alert for each new FasterXML/jackson-databind CVE, with the patched functions and AI-written analysis.

Monitor jackson-databind CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/camel73 CVEs bcgit/bc-java73 CVEs php/php-src73 CVEs wordpress/core73 CVEs ImageMagick/ImageMagick671 CVEs open-webui/open-webui71 CVEs mintplex-labs/anything-llm69 CVEs symfony/symfony76 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in FasterXML/jackson-databind.

How many CVEs have a located fix in FasterXML/jackson-databind?: 72 published CVEs have a fix traced to functions in FasterXML/jackson-databind, touching 105 functions across 50 files.
Which function in FasterXML/jackson-databind has been patched by the most CVEs?: checkIllegalTypes in src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java has been changed by 4 CVE fixes, from 2017 to 2018.
How large is a typical CVE fix in FasterXML/jackson-databind?: The median fix changes 11 lines. 67% of fixes change 20 lines or fewer, and 60% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track FasterXML/jackson-databind CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing