CVE-2019-16335: Polymorphic Typing issue in FasterXML jackson-databind
Summary
CVE-2019-16335: Polymorphic Typing issue in FasterXML jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.6.7.3
>= 2.7.0, < 2.8.11.5
>= 2.9.0, < 2.9.10
Fixed in 2.6.7.3, 2.8.11.5 or 2.9.10, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-16335 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FasterXML jackson-databind library is a popular Java library for serializing and deserializing JSON data. It provides functionality for converting JSON data to Java objects and vice versa. The library is widely used in various applications and frameworks. However, versions before 2.9.10 are vulnerable to a Polymorphic Typing issue that affects the com.zaxxer.hikari.HikariDataSource class. This vulnerability is different from CVE-2019-14540.
Vulnerability Detail
The Polymorphic Typing issue in FasterXML jackson-databind allows an attacker to execute arbitrary code by exploiting the deserialization process. By sending a specially crafted JSON payload, an attacker can trick the application into deserializing it and executing malicious code. This can lead to remote code execution, privilege escalation, and other security breaches. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.8.11.52.8.11.5 -
>= 2.9.0, < 2.9.102.9.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the library to the fixed version as soon as possible.
Conclusion
The Polymorphic Typing issue in FasterXML jackson-databind is a critical vulnerability that can lead to remote code execution and other security breaches. It is important to update the library to version 2.9.10 or later to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
FasterXML jackson-databind is a Java library for serializing and deserializing JSON data. It is widely used in various applications and frameworks.
A Polymorphic Typing issue occurs when a deserialization process does not properly validate the type of the deserialized object. This can allow an attacker to execute arbitrary code by providing a malicious payload.
com.zaxxer.hikari.HikariDataSource is a class in the FasterXML jackson-databind library. It is affected by the Polymorphic Typing issue in versions before 2.9.10.
This vulnerability can lead to remote code execution, privilege escalation, and other security breaches. An attacker can exploit the vulnerability to execute arbitrary code on the target system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
