jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-46877 · ADVISORY
• FasterXML/jackson-databind · WEB
• FasterXML/jackson-databind commit 3ccde7d · WEB
• FasterXML/jackson-databind · PACKAGE
• FasterXML/jackson · WEB
• FasterXML/jackson · WEB
• groups.google.com/g/jackson-user/c/OsBsirPM_Vw · WEB

com.fasterxml.jackson.core:jackson-databind のその他の脆弱性

• CVE-2026-91777高 7.5Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference …
• CVE-2026-91776高 7.5TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied typ…
• CVE-2026-68497高 7.5jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw st…
• CVE-2026-83557中 5.6DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly …
• CVE-2026-19032中 5.3jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStrin…