CVE-2019-16943: Polymorphic typing issue in com.fasterxml.jackson.core:jackson-databind
Summary
CVE-2019-16943: jackson-databind polymorphic typing issue. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.6.7.3
>= 2.7.0, < 2.8.11.5
>= 2.9.0, < 2.9.10.1
Fixed in 2.6.7.3, 2.8.11.5 or 2.9.10.1, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-16943 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.fasterxml.jackson.core:jackson-databind is a popular Java library for serializing and deserializing JSON data. It provides functionality to convert Java objects to JSON and vice versa. This vulnerability affects versions 2.0.0 through 2.9.10 of the library. The vulnerability arises when Default Typing is enabled for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath. An attacker who can find an RMI service endpoint to access can exploit this issue to execute a malicious payload. The vulnerability is due to mishandling of com.p6spy.engine.spy.P6DataSource.
Vulnerability Detail
The vulnerability allows an attacker to execute arbitrary code on the target system by exploiting the Polymorphic Typing issue in FasterXML jackson-databind. By leveraging the presence of p6spy (3.8.6) jar in the classpath, an attacker can make the service execute a malicious payload. This can lead to various consequences, including unauthorized access, data leakage, and remote code execution. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.8.11.52.8.11.5 -
>= 2.9.0, < 2.9.10.12.9.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the jackson-databind library.
Conclusion
The Polymorphic Typing issue in com.fasterxml.jackson.core:jackson-databind (CVE-2019-16943) is a critical vulnerability that allows an attacker to execute arbitrary code on the target system. To mitigate this vulnerability, it is crucial to upgrade the jackson-databind library to version 2.9.10.1 or later. Additionally, ensure that the p6spy (3.8.6) jar is not present in the classpath if it is not required. For further assistance on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
com.fasterxml.jackson.core:jackson-databind is a Java library for JSON serialization and deserialization. It is widely used in Java applications to convert Java objects to JSON and vice versa.
Default Typing is a feature in jackson-databind that allows automatic inclusion of type information during serialization and deserialization. It enables polymorphic type handling.
p6spy is a framework for database statement logging. The p6spy (3.8.6) jar is a specific version of the p6spy library.
An attacker can exploit this vulnerability by finding an RMI service endpoint to access and leveraging the presence of p6spy (3.8.6) jar in the classpath. By making the service execute a malicious payload, the attacker can execute arbitrary code on the target system.
This vulnerability can lead to unauthorized access, data leakage, and remote code execution on the target system. An attacker can exploit the vulnerability to perform various malicious activities.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
