Denial of Service

Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.

1. Denial of Service (DoS)CVE-2020-28491Fasterxml · CVSS 7.5 · 2.4% likely

   CWE-770

2. jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situat…CVE-2021-46877Fasterxml · CVSS 7.5 · 1.1% likely

   CWE-770

3. jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of serviceCVE-2026-68498FasterXML · CVSS 7.5 · 0.7% likely

   CWE-400

4. jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSCVE-2026-89407FasterXML · CVSS 7.5 · 0.6% likely

   CWE-1333

5. jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceCVE-2026-68497FasterXML · CVSS 7.5 · 0.6% likely

   CWE-1333

6. jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()CVE-2026-50193FasterXML · CVSS 6.3 · 0.6% likely

   CWE-400

7. jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource ExhaustionCVE-2026-29062FasterXML · CVSS 7.5 · 0.6% likely

   CWE-770

8. jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of serviceCVE-2026-68496FasterXML · CVSS 7.5 · 0.6% likely

   CWE-770

9. jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of serviceCVE-2026-68495FasterXML · CVSS 7.5 · 0.6% likely

   CWE-770

10. jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growthCVE-2026-89425FasterXML · CVSS 7.5 · 0.5% likely

    CWE-770

11. jackson-databind: quadratic forward-reference completion in Collection and Map deserializersCVE-2026-91777FasterXML · CVSS 7.5 · 0.5% likely

    CWE-400

12. jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type IDCVE-2026-91776FasterXML · CVSS 7.5 · 0.5% likely

    CWE-400

13. jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)CVE-2026-68494FasterXML · CVSS 8.7 · 0.5% likely

    CWE-770

14. jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of serviceCVE-2026-18401FasterXML · CVSS 6.9 · 0.4% likely

    CWE-770

15. jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)CVE-2026-106554FasterXML · CVSS 7.5 · 0.4% likely

    CWE-407

16. jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of serviceCVE-2026-104895FasterXML · CVSS 7.5 · 0.4% likely

    CWE-789

17. jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's pe…CVE-2023-35116Fasterxml · 0.4% likely

    CWE-770

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.