CVE-2019-12384: Deserialization of Untrusted Data in FasterXML jackson-databind

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 45.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-24 · updated 2026-10-08
Weakness: CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Affected products

Debian Linux: 8.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.7.9.6; from 2.8.0 before 2.8.11.4; from 2.9.0 before 2.9.9.1 — fixed in 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.1
Red Hat Enterprise Linux: 7.0, 7.4, 7.5, 7.6, 7.7
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.9.1; from 2.8.0 before 2.8.11.4; from 2.7.0 before 2.7.9.6; from 2.0.0 before 2.6.7.3; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+101) — fixed in 2.9.9.1, 2.8.11.4, 2.7.9.6, 2.6.7.3

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.1; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.9.1, 2.8.11.4, 2.7.9.6, 2.6.7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-12384 or the next vulnerability affects your stack