External risk intelligence

Jackson Databind Polymorphic Deserialization Allows Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2019-14892

Jackson-databind is a widely used Java library for JSON processing, frequently integrated into web applications, APIs, and microservices. Because these applications often process untrusted input from external users, the deserialization surface provided by this library is commonly exposed to the public internet in many standard deployment architectures.

Information Disclosure

Fasterxml Jackson Databind

2.0.0 to before 2.6.7.32.7.0 to before 2.8.11.52.9.0 to before 2.9.107.07.0.04.31.12.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability exists in the popular jackson-databind Java library, which is used by numerous applications and services for processing JSON data. This flaw could allow an unauthorized attacker to execute arbitrary code on affected systems by sending specially crafted malicious data, potentially leading to a significant security breach.

A code execution flaw exists in a common Java data processing library.
It can allow attackers to run unauthorized code on systems.
Assess relevance and impact within your Java application ecosystem.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to an application that uses the affected library. This request would contain a malicious object that, when deserialized, leverages the library's polymorphic deserialization feature along with JNDI classes from commons-configuration. This process allows the attacker to execute arbitrary code on the server, potentially leading to a full system compromise.

No special access is needed.
Malicious object deserialization triggers vulnerability.
Arbitrary code execution is the risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code on a system when it processes specially crafted input through the jackson-databind library, when polymorphic deserialization is enabled and commons-configuration is in use.

System code execution could occur.
Malicious input via deserialization.
Undefined system behavior or compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in `jackson-databind` impacts applications processing untrusted input, making it a concern for development teams and platform administrators. The initial focus should be on identifying all instances of the affected library, assessing their exposure and criticality, and then coordinating with the accountable owners to plan the appropriate remediation.

Application owners should own the resolution.
Verify where `jackson-databind` is deployed.
Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is jackson-databind and why is it used?

Jackson-databind is a popular Java library essential for data processing. It converts JSON data into Java objects and vice versa, a process called deserialization. Because it is highly efficient at handling complex data structures, it is a foundational component in many enterprise software products, including Red Hat middleware like JBoss and OpenShift, as well as Apache Geode, where it facilitates communication between services.

How does CVE-2019-14892 enable arbitrary code execution?

This flaw is classified under CWE-502, which concerns insecure deserialization. The library mistakenly allows polymorphic deserialization, meaning it can be tricked into creating objects of unintended types. Specifically, an attacker can supply a malicious JSON payload that forces the library to interact with dangerous JNDI classes from commons-configuration, effectively tricking the server into executing unauthorized code.

When does this vulnerability trigger?

The vulnerability triggers when an application uses a vulnerable version of jackson-databind to process untrusted input that contains a crafted malicious object. It relies on the specific combination of the library's polymorphic deserialization feature being enabled and the presence of commons-configuration JNDI classes in the environment. It does not trigger if the application does not deserialize untrusted data or if these specific libraries are absent.

Why is this CVE often classified as internet-facing?

According to Halo Surface Signal, this library is frequently embedded in web applications, APIs, and microservices that sit at the network edge to parse user requests. Because these services commonly process untrusted input directly from the public internet, the deserialization surface is often exposed, making it easier for remote attackers to deliver malicious payloads without needing prior access to the internal network.

How should I respond to this vulnerability?

You should start by creating an inventory of all applications within your environment that use the affected versions of jackson-databind. Since this is a library-level issue, your primary goal is to identify where it is deployed and coordinate with the respective application owners. Once mapped, focus on planning and applying the vendor-provided updates to move to a version where this deserialization behavior is properly secured.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.