CVE-2018-12022: Vulnerability in com.fasterxml.jackson.core:jackson-databind
Summary
CVE-2018-12022: jackson-databind Deserialization of Untrusted Data vulnerability. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.7.9.4
>= 2.8.0, < 2.8.11.2
>= 2.9.0, < 2.9.6
Fixed in 2.7.9.4, 2.8.11.2 or 2.9.6, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-12022 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The com.fasterxml.jackson.core:jackson-databind package is a popular library for serializing and deserializing JSON data in Java applications. It provides functionality for converting JSON data to Java objects and vice versa. This vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 of the package. The vulnerability arises when Default Typing is enabled and the Jodd-db jar is present in the classpath. An attacker can exploit this vulnerability by providing an LDAP service to gain unauthorized access and execute malicious payloads.
Vulnerability Detail
The vulnerability in com.fasterxml.jackson.core:jackson-databind allows an attacker to execute arbitrary code on the affected system. By leveraging the presence of the Jodd-db jar and the ability to provide an LDAP service, the attacker can manipulate the deserialization process and inject malicious payloads. This can lead to various consequences, including remote code execution, data leakage, and unauthorized access to sensitive information.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.9.42.7.9.4 -
>= 2.8.0, < 2.8.11.22.8.11.2 -
>= 2.9.0, < 2.9.62.9.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the package is not immediately feasible, a workaround is to disable Default Typing or remove the Jodd-db jar from the classpath. Disabling Default Typing can be done by configuring the ObjectMapper with the disableDefaultTyping() method. Removing the Jodd-db jar from the classpath involves identifying and removing the jar file from the application's dependencies.
Conclusion
The vulnerability in com.fasterxml.jackson.core:jackson-databind can be mitigated by upgrading to a fixed version or applying the provided workarounds. It is crucial to take immediate action to ensure the secure handling of JSON data and prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
com.fasterxml.jackson.core:jackson-databind is a Java library for JSON data serialization and deserialization.
Default Typing is a feature in jackson-databind that allows automatic inclusion of type information during serialization and deserialization.
This vulnerability can lead to remote code execution, data leakage, and unauthorized access to sensitive information.
To fix this vulnerability, upgrade to a fixed version of com.fasterxml.jackson.core:jackson-databind.
Yes, you can disable Default Typing or remove the Jodd-db jar from the classpath as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
