CVE-2019-14379: Deserialization of untrusted data in FasterXML jackson-databind
Summary
CVE-2019-14379: Deserialization of untrusted data in FasterXML jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.7.9.6
>= 2.8.0, < 2.8.11.4
>= 2.9.0, < 2.9.9.2
Fixed in 2.7.9.6, 2.8.11.4 or 2.9.9.2, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-14379 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FasterXML jackson-databind library is a popular Java library for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa. This vulnerability affects versions of jackson-databind prior to 2.9.9.2. The library is commonly used in Maven projects and can be identified by the package name com.fasterxml.jackson.core:jackson-databind.
Vulnerability Detail
The vulnerability, identified as CVE-2019-14379, is a deserialization vulnerability that occurs when untrusted data is deserialized using the jackson-databind library. Specifically, the issue arises when ehcache is used in conjunction with jackson-databind, due to a mishandling of default typing. This vulnerability can be exploited by an attacker to execute arbitrary remote code on the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.9.62.7.9.6 -
>= 2.8.0, < 2.8.11.42.8.11.4 -
>= 2.9.0, < 2.9.9.22.9.9.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the library to ensure the security of the application.
Conclusion
The CVE-2019-14379 vulnerability in FasterXML jackson-databind poses a critical risk to applications utilizing the library for JSON serialization and deserialization. To mitigate this risk, it is essential to upgrade to version 2.9.9.2 or higher of the library. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson-databind is a Java library used for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa.
The vulnerability allows an attacker to execute arbitrary remote code on the affected system, potentially leading to a complete compromise of the system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, the fix for this vulnerability is to upgrade the jackson-databind library to version 2.9.9.2 or higher.
There are no known workarounds for this vulnerability. It is crucial to upgrade to the fixed version of the library.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
