CVE-2019-17267: Improper Input Validation in jackson-databind

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-07 · updated 2026-10-07
Weakness: CWE-502

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Affected products

Debian Linux: 8.0
FasterXML jackson-databind: from 2.0.0 before 2.8.11.5; from 2.9.0 before 2.9.10 — fixed in 2.8.11.5, 2.9.10
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
NetApp Oncommand Api Services: all versions
NetApp OnCommand Workflow Automation: all versions
NetApp Service Level Manager: all versions
NetApp Steelstore Cloud Integrated Storage: all versions
Oracle Customer Management And Segmentation Foundation: before 18.0 — fixed in 18.0
Oracle Goldengate Application Adapters: 19.1.0.0.0
Oracle Corporation Retail Customer Management and Segmentation Foundation: 17.0
Oracle WebLogic Server: 12.2.1.3.0
Red Hat JBoss EAP: 7.2, 7.3
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.10; before 2.8.11.5; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+118) — fixed in 2.9.10, 2.8.11.5

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.8.11.5, 2.9.10; Oracle Customer Management And Segmentation Foundation 18.0; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10, 2.8.11.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-17267 or the next vulnerability affects your stack