CVE-2019-12384: Deserialization of Untrusted Data in FasterXML jackson-databind
Summary
CVE-2019-12384: Deserialization of Untrusted Data in FasterXML jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 4 version ranges.
>= 2.0.0, < 2.6.7.3
>= 2.7.0, < 2.7.9.6
>= 2.8.0, < 2.8.11.4
>= 2.9.0, < 2.9.9.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-12384 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FasterXML jackson-databind is a popular Java library used for serializing and deserializing JSON data. It provides a powerful and flexible API for working with JSON objects. However, versions of jackson-databind prior to 2.9.9.1 are vulnerable to a deserialization issue that can be exploited by attackers. This vulnerability arises from a failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
Vulnerability Detail
The vulnerability in FasterXML jackson-databind allows attackers to exploit the deserialization process and potentially execute arbitrary code on the target system. By sending specially crafted JSON data, an attacker can trigger the deserialization of untrusted data, leading to various impacts. The severity of the impact depends on the classpath content and the attacker's ability to control the deserialized objects. Remote code execution is a possible consequence of this vulnerability.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.7.9.62.7.9.6 -
>= 2.8.0, < 2.8.11.42.8.11.4 -
>= 2.9.0, < 2.9.9.12.9.9.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of jackson-databind to ensure the security of the application.
Conclusion
The vulnerability in FasterXML jackson-databind can have severe consequences, including remote code execution. It is crucial to update to the fixed version of jackson-databind (2.9.9.1 or later) to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
FasterXML jackson-databind is a Java library used for serializing and deserializing JSON data. It provides a flexible API for working with JSON objects.
Depending on the classpath content, this vulnerability can allow remote code execution, potentially leading to unauthorized access, data breaches, or other malicious activities.
To fix this vulnerability, update the jackson-databind library to version 2.9.9.1 or later. This version includes the necessary security fixes.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed version of jackson-databind.
For more information about this vulnerability, you can refer to the CVE-2019-12384 advisory or contact the developers of jackson-databind.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
