CVE-2019-16942: Polymorphic Typing in FasterXML jackson-databind
Summary
CVE-2019-16942: Polymorphic Typing in FasterXML jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.0.0, < 2.6.7.3
>= 2.7.0, < 2.8.11.5
>= 2.9.0, < 2.9.10.1
Fixed in 2.6.7.3, 2.8.11.5 or 2.9.10.1, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-16942 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FasterXML jackson-databind library is a popular Java library used for processing JSON data. It provides functionality for converting JSON data to Java objects and vice versa. The library supports polymorphic typing, which allows the serialization and deserialization of objects with different types. However, a vulnerability has been discovered in versions 2.0.0 through 2.9.10 of jackson-databind that can be exploited when the library is used in conjunction with the commons-dbcp (1.4) jar. This vulnerability can lead to the execution of malicious payloads.
Vulnerability Detail
The vulnerability arises due to the mishandling of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource. When the Default Typing feature is enabled for an externally exposed JSON endpoint and the commons-dbcp jar is present in the classpath, an attacker who can access an RMI service endpoint can exploit this vulnerability to execute a malicious payload. This can have severe consequences, as it allows an attacker to gain unauthorized access to the system and potentially perform arbitrary actions.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.8.11.52.8.11.5 -
>= 2.9.0, < 2.9.10.12.9.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of jackson-databind is not immediately feasible, a possible workaround is to disable the Default Typing feature. This can be done by configuring the ObjectMapper used for JSON serialization and deserialization to not include type information. Here's an example of how to disable Default Typing:
ObjectMapper objectMapper = new ObjectMapper();
objectMapper.disableDefaultTyping();
By disabling Default Typing, the vulnerability can be mitigated, but it is still recommended to upgrade to the latest version of jackson-databind as soon as possible.
Conclusion
The Polymorphic Typing vulnerability in FasterXML jackson-databind can have severe consequences if exploited. It is crucial to upgrade to the latest version of jackson-databind (2.9.10.1 or later) to mitigate this vulnerability. If immediate upgrading is not possible, disabling the Default Typing feature can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
FasterXML jackson-databind is a Java library used for processing JSON data. It provides functionality for converting JSON data to Java objects and vice versa.
Polymorphic typing is a feature in jackson-databind that allows the serialization and deserialization of objects with different types. It enables the handling of complex object hierarchies and inheritance relationships.
This vulnerability occurs due to the mishandling of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource when the Default Typing feature is enabled and the commons-dbcp jar is present in the classpath.
The exploitation of this vulnerability can lead to the execution of malicious payloads, allowing an attacker to gain unauthorized access to the system and potentially perform arbitrary actions.
To fix this vulnerability, it is recommended to upgrade to version 2.9.10.1 or later of jackson-databind. Alternatively, you can disable the Default Typing feature as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
