Sign inStart freeBook a demo

Fasterxml vulnerabilitiesNone on the known-exploited list.

Vendor
The short answer

Fasterxml has 77 published vulnerabilities across 9 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Jackson-Databind, with 70. If you run Fasterxml software, patch the exploited flaws first.

See the exploited flaws

We keep watching the known-exploited list.

Products

Which Fasterxml products have the most vulnerabilities?

Jackson-Databind leads with 70 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.

  1. Jackson-Databind70
  2. Jackson-Dataformat-XML2
  3. Jackson-Dataformats-Text1
  4. Woodstox1
  5. Jackson-Dataformats-Binary1
  6. Jackson-Mapper-Asl1
  7. Jackson-Modules-Java81
  8. Jackson-Core0
  9. Jackson0
Published vulnerabilities
Known exploited

Which Fasterxml vulnerabilities are being exploited?

This is the list that matters most: flaws criminals are using now.

None of Fasterxml's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.

Exploit likelihood

Which Fasterxml flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.

50% or more10% to 49%Under 10%
  1. 50%
    CVE-2017-17485Critical

    FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw.

    CVSS9.8Published10 Jan 2018
  2. 45%
    CVE-2019-12384Medium

    FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization.

    CVSS5.9Published24 Jun 2019
  3. 38%
    CVE-2017-7525Critical

    A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input...

    CVSS9.8Published6 Feb 2018
  4. 27%
    CVE-2020-8840Critical

    FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

    CVSS9.8Published10 Feb 2020
  5. 22%
    CVE-2019-12086High

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.

    CVSS7.5Published17 May 2019
  6. 20%
    CVE-2018-7489Critical

    FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw.

    CVSS9.8Published26 Feb 2018
  7. 19%
    CVE-2020-9548Critical

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

    CVSS9.8Published2 Mar 2020
  8. 19%
    CVE-2022-40152Medium

    Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled.

    CVSS6.5Published16 Sep 2022
  9. 18%
    CVE-2020-9547Critical

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

    CVSS9.8Published2 Mar 2020
  10. 18%
    CVE-2020-25649High

    A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

    CVSS7.5Published3 Dec 2020
Every product

All Fasterxml products we track.

9 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.

Precursor Intelligence

Running Fasterxml? We'll keep checking.

Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.

  1. Tell us what you runPick your software from a list, or let us work it out from your website.
  2. We match it to every flawOver 400,000 published flaws, checked against your list.
  3. Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
  4. Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Start free →Book a demo

Free plan, no card needed. Nothing to install.

FAQ

Common questions, answered plainly.

Something else? Talk to the team →

Our catalogue lists 77 published vulnerabilities across 9 products and 638 versions from Fasterxml.

None of Fasterxml's vulnerabilities is on the list of flaws known to be exploited today.

Jackson-Databind, with 70 published vulnerabilities. Its own page lists the ones known to be exploited.

Create a Precursor Intelligence account and track the Fasterxml products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

Keep exploring