CVE-2019-16943: jackson-databind polymorphic typing issue

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-01 · updated 2026-10-07
Weakness: CWE-502

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Affected products

Debian Linux: 8.0, 9.0, 10.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.8.11.5; from 2.9.0 before 2.9.10.1 — fixed in 2.6.7.3, 2.8.11.5, 2.9.10.1
Fedoraproject Fedora: 30, 31
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
NetApp Oncommand Api Services: all versions
NetApp OnCommand Workflow Automation: all versions
NetApp Service Level Manager: all versions
NetApp Steelstore Cloud Integrated Storage: all versions
Oracle Banking Platform: 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2 (+3)
Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
Oracle Communications Calendar Server: 8.0.0.2.0, 8.0.0.3.0
Oracle Communications Cloud Native Core Network Slice Selection Function: 1.2.1
Oracle Communications Evolved Communications Application Server: 7.1
Oracle Corporation Global Lifecycle Management NextGen OUI Framework: 12.2.1.3.0, 12.2.1.4.0, 13.9.4.2.2
Oracle Goldengate Application Adapters: 19.1.0.0.0
Oracle Corporation JD Edwards EnterpriseOne Orchestrator: 9.2
Oracle Corporation JD Edwards EnterpriseOne Tools: 9.2
Oracle Corporation Primavera Gateway: from 17.7 through 17.12.6; from 18.8.0 through 18.8.8; 16.1, 16.2, 19.12.0
Oracle Corporation Retail Merchandising System: 15.0.3, 16.0.2, 16.0.3
Oracle Retail Sales Audit: 14.1
Oracle Siebel Engineering - Installer & Deployment: through 2.20.5
Oracle Trace File Analyzer: 12.2.0.1, 18c, 19c
Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
Oracle Corporation Oracle WebCenter Sites: 12.2.1.3.0, 12.2.1.4.0
Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0
Red Hat JBoss EAP: 7.2, 7.3
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.10.1; from 2.7.0 before 2.8.11.5; before 2.6.7.3; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+113) — fixed in 2.9.10.1, 2.8.11.5, 2.6.7.3

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.8.11.5, 2.9.10.1; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.1, 2.8.11.5, 2.6.7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-16943 or the next vulnerability affects your stack