FasterXML product
jackson-databind
Tracked since 29 Oct · latest article 29 Oct · RSS · API
None open
of 0 in the full CISA catalogue · all time
EPSS top 5%, not in KEV
usual rate
Exploited, by due date
No jackson-databind CVE is in the CISA KEV catalogue.
Patch cadence and exploit odds
How often CISA adds jackson-databind CVEs, how many have a fix, and where their exploit odds sit.
Added to CISA KEV per quarter
CISA has not added a jackson-databind CVE to KEV.
Fix listed
1 of 2 CVEs in coverage
1 CVE has no vendor fix recorded yet.
EPSS percentile of each CVE
One dot per CVE; a red diamond marks those in CISA KEV.
Show as tableHide table
| CVE | EPSS percentile |
|---|---|
| CVE-2026-110879 | 68 |
| CVE-2026-54512 | 60.9 |
Coverage1 article · all time
The latest article naming jackson-databind, in the shared story grammar.
1 article from 1 outlet since 29 Oct. Still developing; the latest report was 2 hours ago.
- Thu 29 Oct, 02:00 UTC. SecurityOnline, first report. FasterXML discloses critical Jackson deserialisation flaw.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 1 articles as a listHide the list
- Thu 29 OctDay 01
- FasterXML discloses critical Jackson deserialisation flaw02:00 · SecurityOnline · First report
All CVEs in coverage2
Exploited first, then by EPSS
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
9.8Critical1.2% EPSS · 1 articlejackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
8.1High0.9% EPSS · 1 article