Defined in 8 files
Last patched
deserialize in FasterXML/jackson-databind was changed by 4 published CVE fixes between 2022 and 2026, in 9 distinct patches that added or removed 297 lines in total.
The name occurs in 8 files: src/main/java/com/fasterxml/jackson/databind/deser/std/NumberDeserializers.java, src/main/java/com/fasterxml/jackson/databind/deser/std/StackTraceElementDeserializer.java, src/main/java/com/fasterxml/jackson/databind/deser/std/EnumDeserializer.java, src/main/java/com/fasterxml/jackson/databind/deser/std/StringDeserializer.java, src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java, src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java, src/main/java/com/fasterxml/jackson/databind/deser/std/MapEntryDeserializer.java, src/main/java/com/fasterxml/jackson/databind/deser/std/UntypedObjectDeserializer.java.
FasterXML/jackson-databind has 72 CVEs with a located fix in total, so 6% of them touched this function.
Every published CVE whose fix changed deserialize, newest first, with the lines each fix touched.
CVE-2026-19032 · src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java · lines 110–126 · +12 −2
CVE-2022-42003 · src/main/java/com/fasterxml/jackson/databind/deser/std/EnumDeserializer.java · lines 114–126 · +13 −0
CVE-2022-42004 · src/main/java/com/fasterxml/jackson/databind/deser/std/EnumDeserializer.java · lines 114–126 · +13 −0
CVE-2022-42004 · src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java · lines 102–111 · +10 −0
CVE-2022-42003 · src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java · lines 102–111 · +10 −0
CVE-2022-42003 · src/main/java/com/fasterxml/jackson/databind/deser/std/MapEntryDeserializer.java · lines 178–181 · +2 −5
CVE-2022-42003 · src/main/java/com/fasterxml/jackson/databind/deser/std/NumberDeserializers.java · lines 241–593 · +48 −4 in 5 hunks
CVE-2022-42004 · src/main/java/com/fasterxml/jackson/databind/deser/std/NumberDeserializers.java · lines 241–593 · +48 −4 in 5 hunks
CVE-2022-42003 · src/main/java/com/fasterxml/jackson/databind/deser/std/StackTraceElementDeserializer.java · lines 49–59 · +10 −0
CVE-2022-42004 · src/main/java/com/fasterxml/jackson/databind/deser/std/StackTraceElementDeserializer.java · lines 49–59 · +10 −0
CVE-2022-42003 · src/main/java/com/fasterxml/jackson/databind/deser/std/StringDeserializer.java · lines 27–36 · +10 −0
CVE-2022-42004 · src/main/java/com/fasterxml/jackson/databind/deser/std/StringDeserializer.java · lines 27–36 · +10 −0
CVE-2020-36518 · src/main/java/com/fasterxml/jackson/databind/deser/std/UntypedObjectDeserializer.java · lines 700–769 · +49 −37
Get an alert when the next CVE fix lands in FasterXML/jackson-databind, with the patched functions.
Monitor jackson-databind CVEsFunctions in the same files that CVE fixes also changed.
Functions in FasterXML/jackson-databind changed by the most CVE fixes.
Common questions about CVE fixes to deserialize.
Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.
Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.
