Top jackson-databind issues

Denial of service when parsing a big JSON number as Instant/ZonedDateTime/OffsetDateTime

ACTIVE
plokhotnyuk picture plokhotnyuk·18 Sep 2018·27 Comments
👍13 😕2

field detection regression between Jackson 2.8 and 2.9

hgschmie picture hgschmie·15 Mar 2018·10 Comments

Another two gadgets to exploit default typing issue in jackson-databind (CVE-2018-5968)

CVE
OneSourceCat picture OneSourceCat·18 Jan 2018·20 Comments

RFE: Add support for static @JsonCreator factory methods in Mixin classes

loesak picture loesak·12 Nov 2017·8 Comments
👍15

Problem with multi-argument Creator with `@JsonBackReference` property

lombok
sarahlikesglitter picture sarahlikesglitter·3 Feb 2017·27 Comments
👍6

@JsonProperty annotation ignored

oliverdain picture oliverdain·6 Jan 2017·6 Comments

Block one more gadget type (xbean-reflect/JNDI - CVE-2020-8840)

CVE
cowtowncoder picture cowtowncoder·9 Feb 2020·6 Comments

RFE for 3.x: separate module for default typing

MarkusKull picture MarkusKull·8 Aug 2019·4 Comments
👍7

Block one more gadget type (logback, CVE-2019-12384)

CVE
cowtowncoder picture cowtowncoder·28 May 2019·10 Comments

Add abstraction `PolymorphicTypeValidator`, for limiting subtypes allowed by default typing, `@JsonTypeInfo`

cowtowncoder picture cowtowncoder·6 Dec 2018·10 Comments
👍4
 Previous issues
Next issues