FasterXML/jackson-databind
3.x@ 667475cFixes5
CVEs50
Peak severityCritical
Commits9,106
Regression coverage33.3%
Highlights
Unsafe Deserialization: 4 prior fixes. Scrutinize any change in this area.
FromStringDeserializer.java: most-fixed (1 issue). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
SSRF: 1 historical fix(es) link FromStringDeserializer.java to SSRF.
Unsafe Deserialization: 1 historical fix(es) link src/main/java/com/fasterxml/jackson/databind/DatabindContext.java to Unsafe Deserialization.
Unsafe Deserialization: 1 historical fix(es) link src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java to Unsafe Deserialization.
Last analyzed 30 Sep 2026, 02:51 UTC