CVE-2019-12814: Deserialization of untrusted data in FasterXML jackson-databind

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-19 · updated 2026-06-17
Weakness: CWE-502

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.

Affected products

Debian Linux: 8.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.7.9.6; from 2.8.0 before 2.8.11.4; from 2.9.0 before 2.9.9.2 — fixed in 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.2
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.9.1; from 2.8.0 before 2.8.11.4; from 2.7.0 before 2.7.9.6; from 2.0.0 before 2.6.7.3; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+101) — fixed in 2.9.9.1, 2.8.11.4, 2.7.9.6, 2.6.7.3

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.2; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.9.1, 2.8.11.4, 2.7.9.6, 2.6.7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-12814 or the next vulnerability affects your stack