CVE-2019-14892: Polymorphic deserialization of malicious object in jackson-databind
Summary
CVE-2019-14892: Polymorphic deserialization of malicious object in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.6.7.3
>= 2.7.0, < 2.8.11.5
>= 2.9.0, < 2.9.10
Fixed in 2.6.7.3, 2.8.11.5 or 2.9.10, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-14892 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa. This vulnerability affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3 of the package. The vulnerability allows for polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. This can be exploited by an attacker to execute arbitrary code.
Vulnerability Detail
The vulnerability arises from a flaw in the jackson-databind library that permits the deserialization of a malicious object. By leveraging the commons-configuration 1 and 2 JNDI classes, an attacker can craft a payload that, when deserialized, executes arbitrary code. This can lead to remote code execution and potential compromise of the affected system. The vulnerability has a CVSS score of 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.8.11.52.8.11.5 -
>= 2.9.0, < 2.9.102.9.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if upgrading the library is not immediately feasible, it is recommended to disable polymorphic deserialization in the jackson-databind library. This can be achieved by configuring the ObjectMapper with the disableDefaultTyping() method. Here is an example of how to disable polymorphic deserialization:
ObjectMapper mapper = new ObjectMapper().disableDefaultTyping();
By disabling polymorphic deserialization, the vulnerability can be mitigated until the library is updated.
Conclusion
In conclusion, the jackson-databind library is vulnerable to a polymorphic deserialization issue that allows for the execution of arbitrary code. It is crucial to upgrade to a fixed version of the library to mitigate this vulnerability. If immediate upgrading is not possible, disabling polymorphic deserialization can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
jackson-databind is a Java library used for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa.
Versions before 2.9.10, 2.8.11.5, and 2.6.7.3 of the jackson-databind library are affected by this vulnerability.
An attacker can exploit this vulnerability by crafting a malicious object that, when deserialized using the jackson-databind library, executes arbitrary code. By leveraging the commons-configuration 1 and 2 JNDI classes, the attacker can achieve remote code execution.
The CVSS score of this vulnerability is 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
To fix this vulnerability, it is recommended to upgrade to a fixed version of the jackson-databind library. Details on the specific versions to upgrade to can be found in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
