CVE-2018-14718: Arbitrary Code Execution in jackson-databind
Summary
CVE-2018-14718: Arbitrary Code Execution in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 4 version ranges.
>= 2.0.0, < 2.6.7.3
>= 2.7.0, < 2.7.9.5
>= 2.8.0, < 2.8.11.3
>= 2.9.0, < 2.9.7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-14718 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa. This vulnerability affects versions 2.x before 2.9.7 of the package. The vulnerability arises from a failure to block the slf4j-ext class during polymorphic deserialization, which can be exploited by remote attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability in jackson-databind allows remote attackers to execute arbitrary code by leveraging the failure to block the slf4j-ext class during polymorphic deserialization. This can lead to serious consequences, such as unauthorized access, data manipulation, or even complete system compromise. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.7.9.52.7.9.5 -
>= 2.8.0, < 2.8.11.32.8.11.3 -
>= 2.9.0, < 2.9.72.9.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround is to disable polymorphic deserialization in the jackson-databind package. This can be achieved by configuring the ObjectMapper with the disableDefaultTyping() method. Here's an example:
ObjectMapper mapper = new ObjectMapper().disableDefaultTyping();
Conclusion
The vulnerability in jackson-databind can lead to arbitrary code execution and has a critical severity. It is crucial to upgrade to version 2.9.7 or later of the package to mitigate this vulnerability. If immediate upgrade is not possible, disabling polymorphic deserialization can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
jackson-databind is a Java library used for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa.
Polymorphic deserialization is a feature of jackson-databind that allows the deserialization of JSON data into different types of Java objects based on the information present in the JSON itself.
The vulnerability occurs due to a failure to block the slf4j-ext class during polymorphic deserialization in jackson-databind. This allows remote attackers to execute arbitrary code.
The consequences of this vulnerability can be severe, including unauthorized access, data manipulation, or complete system compromise. Attackers can exploit this vulnerability to execute arbitrary code on the affected system.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
