HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
FasterXML
jackson-databind
Java2018–2023
FasterXML / jackson-databind

jackson-databind

General data-binding package for Jackson: works on streaming API (core) implementation(s)

Data & DatabasesLibraries & SDKs
Explore on GitHubRead Hacker News discussions
9Distinct people
11Mentions
0Explicit recommenders
3.8KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

General data-binding package for Jackson: works on streaming API (core) implementation(s)

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 2:17:07 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year11 dated mentions

Observed mentions: 2018-05-02 20:23:43 UTC to 2023-09-22 05:59:54 UTC.

02462018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments2023

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC101
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC615
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC110
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC000
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC312

What Hacker News says

6 sources
based2·Oct 6, 2019
https://github.com/FasterXML/jackson-databind/issues/2410 Block one more gadget type (HikariCP, CVE-2019-14540) https://github.com/FasterXML/jackson-databind/issues/2478 Block two more gadget types (commons-dbcp, p6spy, CVE-2019-16942 / CVE-2019-16943) https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-... # Safe Default Typing (safe Polymorphic Deserialization) https://medium.com/@cowtowncoder/jackson-2-10-features-cd880...
In Jackson-databind – remote code execution vulnerability
twic·Oct 6, 2019
The email has a list of CVEs. Some are related to quite old bugs, as described here: https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-... The most recent relates to blocking yet another gadget: https://github.com/FasterXML/jackson-databind/issues/2478 As another commenter mentions, this whole set of issues is only a problem if you call enableDefaultTyping during setup, and then deserialise data from untrusted sources. Doubtless, there are people doing this. But don't.
In Jackson-databind – remote code execution vulnerability
lol768·Oct 6, 2019
>it is apparently on by default Curious as to what makes you think this - I was under the impression you needed to explicitly call `enableDefaultTyping` to get this unsafe behaviour. The wiki page explicitly tells you not to do this with untrusted input and the method is deprecated in the latest versions of the library. https://github.com/FasterXML/jackson-databind/issues/2195 https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymo...
In Jackson-databind – remote code execution vulnerability
siddcoder·Jun 29, 2019
It is not necessary. I chose to build a protobuf based serialization and communication since it is widely used in distributed system and more performant than JSON based serialization. Another reason was ease of use especially because Netty already supports message encoders and decoders for conversion between protobuf and bytebuf. You could also use https://github.com/FasterXML/jackson-databind but that would require a reasonable amount of custom code for the encoder and decoders
In Building RPC layer in a distributed system using Netty – A tutorial

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.