Description
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.9.8-1 | — |
| Debian 13 | jackson-databind | 2.9.8-1 | — |
| Debian 12 | jackson-databind | 2.9.8-1 | — |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u5 | DSA-4452-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u5 | DLA-1703-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 | USN-4813-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-maven35-jackson-databind +1 | 2.7.6-2.5.el7 | RHSA-2019:0782 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +16 | 2.6.3-5.redhat_00020.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-lang | 3.8.0-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.7-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 2.6.3-15.redhat_00020.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-byte-buddy | 1.9.5-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-cxf-xjc-dv +5 | 3.2.3-2.redhat_00002.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-dom4j | 2.1.1-2.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.2.4-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.9-2.Final_redhat_00002.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-asyncclient | 4.1.4-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.3.6-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.15-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +5 | 2.9.8-2.redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +4 | 2.9.8-1.redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.15-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-el-api_3.0_spec | 1.0.13-2.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.1-2.Final_redhat_00002.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.7-3.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting-jmx | 3.0.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-security-negotiation | 3.0.5-2.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +22 | 1.3.0-7.Final_redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-16.SP12_redhat_4.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-4.SP3_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-sun-istack-commons +2 | 3.0.7-2.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.7-2.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.1-6.GA_redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.4.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.13-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.1-6.GA_redhat_00004.1.el7eap | RHSA-2019:1108 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.3-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.2-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.7 | 2.9.7 | GHSA-x2w5-5m2g-7h5m |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.8.0, < 2.8.11.3 | 2.8.11.3 | GHSA-x2w5-5m2g-7h5m |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.7.0, < 2.7.9.5 | 2.7.9.5 | GHSA-x2w5-5m2g-7h5m |
Advisories 8
- USN-4813-1 jackson-databind vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- RHSA-2019:1108 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1107 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0782 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4452-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1703-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-1682 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2024
References
- https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
- https://github.com/FasterXML/jackson-databind/issues/2097
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
- [debian-lts-announce] 20190304 [SECURITY] [DLA 1703-1] jackson-databind security update mailing-list
- [lucene-dev] 20190325 [jira] [Assigned] (SOLR-13112) CVE-2018-14718(-14719),sonatype-2017-0312, CVE-2018-14720(-14721) Threat Level 8 Against Solr v7.6. com.fasterxml.jackson.core : jackson-databind : 2.9.6. FasterXML jackson-databind 2.x before 2.9. mailing-list
- [lucene-dev] 20190325 [jira] [Updated] (SOLR-13112) CVE-2018-14718(-14719),sonatype-2017-0312, CVE-2018-14720(-14721) Threat Level 8 Against Solr v7.6. com.fasterxml.jackson.core : jackson-databind : 2.9.6. FasterXML jackson-databind 2.x before 2.9.7 mailing-list
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- [lucene-dev] 20190325 [jira] [Updated] (SOLR-13112) CVE-2018-14718(-14719),sonatype-2017-0312, CVE-2018-14720(-14721) Threat Level 8 Against Solr v7.6. com.fasterxml.jackson.core : jackson-databind : 2.9.6. FasterXML jackson-databind 2.x before 2.9.7 mailing-list
- RHSA-2019:0782 vendor-advisory
- RHBA-2019:0959 vendor-advisory
- RHSA-2019:1107 vendor-advisory
- RHSA-2019:1108 vendor-advisory
- RHSA-2019:1106 vendor-advisory
- RHSA-2019:1140 vendor-advisory
- DSA-4452 vendor-advisory
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security update mailing-list
- https://security.netapp.com/advisory/ntap-20190530-0003/
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- RHSA-2019:1822 vendor-advisory
- RHSA-2019:1823 vendor-advisory
- RHSA-2019:2858 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- RHSA-2019:3149 vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- RHSA-2019:3892 vendor-advisory
- RHSA-2019:4037 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list