CVE-2019-14540: Polymorphic Typing issue in FasterXML jackson-databind

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-15 · updated 2026-10-08
Weakness: CWE-502

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Affected products

Debian Linux: 8.0, 9.0, 10.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.8.11.5; from 2.9.0 before 2.9.10 — fixed in 2.6.7.3, 2.8.11.5, 2.9.10
Fedoraproject Fedora: 30, 31
NetApp Oncommand Api Services: all versions
NetApp OnCommand Workflow Automation: all versions
NetApp Steelstore Cloud Integrated Storage: all versions
Oracle Banking Platform: 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.7.0 (+1)
Oracle Customer Management And Segmentation Foundation: 18.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.2 through 8.0.8
Oracle Global Lifecycle Management Opatch: before 11.2.0.3.23; from 12.2.0.1.0 before 12.2.0.1.19; from 13.9.4.0.0 before 13.9.4.2.1 — fixed in 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1
Oracle Goldengate Application Adapters: 19.1.0.0.0
Oracle Corporation GoldenGate Stream Analytics: before 19.1.0.0.1 — fixed in 19.1.0.0.1
MySQL Server: from 5.7.0 through 5.7.30; from 8.0.0 through 8.0.20
Oracle Corporation Primavera Gateway: 15.2, 15.2.18, 16.2, 16.2.11, 17.12, 17.12.6 (+2)
Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12
Oracle Corporation Retail Customer Management and Segmentation Foundation: 17.0
Oracle Corporation Retail Xstore Point of Service: 7.1, 15.0, 16.0, 17.0, 18.0
Oracle WebLogic Server: 12.2.1.3.0
Red Hat JBoss EAP: 7.2, 7.3
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.10; from 2.7.0 before 2.8.11.5; before 2.6.7.3; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+112) — fixed in 2.9.10, 2.8.11.5, 2.6.7.3

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.8.11.5, 2.9.10; Oracle Global Lifecycle Management Opatch 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1; Oracle Corporation GoldenGate Stream Analytics 19.1.0.0.1; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10, 2.8.11.5, 2.6.7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-14540 or the next vulnerability affects your stack