CVE-2019-12086 FasterXML jackson-databind
| Affected software | FasterXML jackson-databind |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 2.9.9, 2.8.11.4, 2.7.9.6, 2.6.7.3 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 17 May 2019 |
| Updated | 8 Oct 2026 |
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. The 2 repositories below are public GitHub repositories with fewer than 5 stars.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 2 indexed, none at 5+ stars
- EPSS 22% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | jackson unserialize | 1 | 2020-05-22 |
| GitHub PoC | motoyasu-saburi/CVE-2019-12086-jackson-databind-file-read | 1 | 2019-05-27 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE is covered by a multi-CVE ARMR patch rule |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2019-12086.armr patch rule, ARMR 2.6 added 2020-06-25 updated 2026-03-04How to mitigate CVE-2019-12086
Upgrade FasterXML jackson-databind to a release that fixes it: 2.9.9, 2.8.11.4, 2.7.9.6 or 2.6.7.3. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle GoldenGate / Internal Framework (jackson-databind) (Prior to 12.3.0.1.2) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Retail Applications / Segment (jackson-databind) (18.0) |
| Oracle Critical Patch Update January 2020 ↗ | CPU | 2020-Q1 | Oracle JD Edwards / E1 IOT Orchestrator Security (jackson-databind) (9.2) Oracle JD Edwards / Monitoring and Diagnostics SEC (jackson-databind) (9.2) Oracle JD Edwards / Web Runtime SEC (jackson databind) (9.2) |
| Oracle Critical Patch Update October 2019 ↗ | CPU | 2019-Q4 | Oracle Fusion Middleware / Security Framework (jackson-databind) (12.2.1.3.0) Oracle Retail Applications / Xenvironment (jackson-databind) (7.1, 15.0, 16.0, 17.0, 18.0) |
| Oracle Critical Patch Update July 2019 ↗ | CPU | 2019-Q3 | Oracle Communications Applications / Billing Care, Business Operations Center (jackson-databind) (7.5, 12.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | Billing Care, Business Operations Center (jackson-databind) | 7.5, 12.0 | 7.5 · 12.0 |
| Oracle Fusion Middleware | Security Framework (jackson-databind) | 12.2.1.3.0 | 12.2.1.3.0 |
| Oracle GoldenGate | Internal Framework (jackson-databind) | Prior to 12.3.0.1.2 | |
| Oracle JD Edwards | E1 IOT Orchestrator Security (jackson-databind) | 9.2 | 9.2 |
| Oracle JD Edwards | Monitoring and Diagnostics SEC (jackson-databind) | 9.2 | 9.2 |
| Oracle JD Edwards | Web Runtime SEC (jackson databind) | 9.2 | 9.2 |
| Oracle Retail Applications | Segment (jackson-databind) | 18.0 | 18.0 |
| Oracle Retail Applications | Xenvironment (jackson-databind) | 7.1, 15.0, 16.0, 17.0, 18.0 | 7.1 · 15.0 · 16.0 · 17.0 · 18.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
com.fasterxml.jackson.core:jackson-databind |
2.9.0 | 2.9.9 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.8.0 | 2.8.11.4 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.7.0 | 2.7.9.6 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.0.0 | 2.6.7.3 |
unbounded |
Products and versions
3 products, 10 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | com.fasterxml.jackson.core | jackson-databind | generic | ≥ 2.0.0 and ＜ 2.6.7.3 · ≥ 2.7.0 and ＜ 2.7.9.6 · ≥ 2.8.0 and ＜ 2.8.11.4 · ≥ 2.9.0 and ＜ 2.9.9 |
| nvd | debian | debian linux | generic | 8.0 · 9.0 |
| nvd | fasterxml | jackson-databind | generic | ≥ 2.0.0 and ＜ 2.6.7.3 · ≥ 2.7.0 and ＜ 2.7.9.6 · ≥ 2.8.0 and ＜ 2.8.11.4 · ≥ 2.9.0 and ＜ 2.9.9 |
References
Timeline
Timeline
| Published | 2019-05-17 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2020-06-25 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |