Defined in 2 files
Last patched
_deserialize in FasterXML/jackson-databind was changed by 2 published CVE fixes in 2026, in 4 distinct patches that added or removed 17 lines in total.
The name occurs in 2 files: src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java, src/main/java/com/fasterxml/jackson/databind/ext/CoreXMLDeserializers.java.
FasterXML/jackson-databind has 72 CVEs with a located fix in total, so 3% of them touched this function.
Every published CVE whose fix changed _deserialize, newest first, with the lines each fix touched.
CVE-2026-68497 · src/main/java/com/fasterxml/jackson/databind/ext/CoreXMLDeserializers.java · lines 112–127 · +12 −0
CVE-2026-19032 · src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java · lines 171–174 · +4 −1
Get an alert when the next CVE fix lands in FasterXML/jackson-databind, with the patched functions.
Monitor jackson-databind CVEsFunctions in the same files that CVE fixes also changed.
Functions in FasterXML/jackson-databind changed by the most CVE fixes.
Common questions about CVE fixes to _deserialize.
Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.
Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.
