jackson-databind + jackson-core 26 条安全公告自查:按坐标逐条求交集给出真正到位的版本(2.18.11/2.21.7/2.22.3/3.1.7/3.2.3,2.21.6 已不够);扫源码降噪告诉你真中几条;含 1 条 GitHub 全局库未收录、Dependabot 不报的(jackson-core 那条,升了 databind 也照样中) CVE-2026-54515 / CVE-2026-54512
java security deserialization jackson cve vulnerability-scanner jackson-databind dependency-check jsonview cve-2026-54512 cve-2026-54513 cve-2026-54514 cve-2026-54515 cve-2026-54516 cve-2026-54517 cve-2026-54518 cve-2026-59888 cve-2026-59889 cve-2026-50193 polymorphictypevalidator
-
Updated
Oct 4, 2026 - Java