createContextual
Defined in 3 files
Last patched
Overview
createContextual in FasterXML/jackson-databind was changed by 3 published CVE fixes between 2019 and 2026, in 3 distinct patches that added or removed 9 lines in total.
The name occurs in 3 files: src/main/java/tools/jackson/databind/deser/bean/BeanDeserializerBase.java, src/main/java/com/fasterxml/jackson/databind/ser/std/BeanSerializerBase.java, src/main/java/com/fasterxml/jackson/databind/deser/std/UntypedObjectDeserializer.java.
FasterXML/jackson-databind has 72 CVEs with a located fix in total, so 4% of them touched this function.
CVEs that patched it
Every published CVE whose fix changed createContextual, newest first, with the lines each fix touched.
CVE-2026-54515 · src/main/java/tools/jackson/databind/deser/bean/BeanDeserializerBase.java · lines 869–872 · +4 −1
Medium · CVSS 5.3EPSS 0.4%2026-06-23CVE-2020-36518 · src/main/java/com/fasterxml/jackson/databind/deser/std/UntypedObjectDeserializer.java · line 199 · +1 −1
High · CVSS 7.5EPSS 4.9%2022-03-11CVE-2019-16942 · src/main/java/com/fasterxml/jackson/databind/ser/std/BeanSerializerBase.java · line 429 · +1 −1
Critical · CVSS 9.8EPSS 5.7%2019-10-01
Get an alert when the next CVE fix lands in FasterXML/jackson-databind, with the patched functions.
Monitor jackson-databind CVEsOther functions in these files
Functions in the same files that CVE fixes also changed.
- 1mapArraysrc/main/java/com/fasterxml/jackson/databind/deser/std/UntypedObjectDeserializer.java1 CVEs · 3 patches2022
- 2mapObjectsrc/main/java/com/fasterxml/jackson/databind/deser/std/UntypedObjectDeserializer.java1 CVEs · 3 patches2022
- 3mapArrayToArraysrc/main/java/com/fasterxml/jackson/databind/deser/std/UntypedObjectDeserializer.java1 CVEs · 2 patches2022
- 4deserializesrc/main/java/com/fasterxml/jackson/databind/deser/std/UntypedObjectDeserializer.java1 CVEs · 1 patches2022
Other hotspots in the repository
Functions in FasterXML/jackson-databind changed by the most CVE fixes.
Frequently asked questions
Common questions about CVE fixes to createContextual.
- How many CVEs have patched createContextual?
- 3 published CVEs changed createContextual in FasterXML/jackson-databind, in 3 distinct patches totalling 9 changed lines, between 2019 and 2026.
- What is the latest CVE that changed createContextual?
- CVE-2026-54515 (jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties), published 2026-06-23, changed lines 869 to 872 of src/main/java/tools/jackson/databind/deser/bean/BeanDeserializerBase.java.
- How does createContextual compare to the rest of FasterXML/jackson-databind?
- FasterXML/jackson-databind has 72 CVEs with a located fix in total; 3 of them changed createContextual.
- What do the line numbers refer to?
- Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.
References
- src/main/java/tools/jackson/databind/deser/bean/BeanDeserializerBase.java on GitHub (opens in a new tab)
- src/main/java/com/fasterxml/jackson/databind/ser/std/BeanSerializerBase.java on GitHub (opens in a new tab)
- src/main/java/com/fasterxml/jackson/databind/deser/std/UntypedObjectDeserializer.java on GitHub (opens in a new tab)
- All patched functions in FasterXML/jackson-databind
- Patched functions directory
Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.
Track FasterXML/jackson-databind CVEs
Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.