FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Fix
Patch, vendor advisory and mitigation references on NVD 12
- https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44 Patch, Third Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2097 Issue Tracking, Patch, Third Party Advisory
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7 Patch, Release Notes, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Third Party Advisory
- https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44 Patch, Third Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2097 Issue Tracking, Patch, Third Party Advisory
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7 Patch, Release Notes, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · fasterxml, debian, oracleNVD modified 2026-10-15 18:17
Affected (CPE criteria) 38
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.7.0:rc1:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.7.0:rc2:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.7.0:rc3:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.8.0:rc1:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.8.0:rc2:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.9.0:pr1:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.9.0:pr2:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.9.0:pr3:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.9.0:pr4:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7:*:*:*:*:*:*:*cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_merchandising_system:16.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
References 64
- https://access.redhat.com/errata/RHBA-2019:0959 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0782 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1106 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1107 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1108 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1140 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1822 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1823 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3149
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4037
- https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44 Patch, Third Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2097 Issue Tracking, Patch, Third Party Advisory
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7 Patch, Release Notes, Third Party Advisory
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html Third Party Advisory
- https://seclists.org/bugtraq/2019/May/68 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190530-0003/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4452 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://access.redhat.com/errata/RHBA-2019:0959 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0782 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1106 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1107 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1108 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1140 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1822 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1823 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3149
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4037
- https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44 Patch, Third Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2097 Issue Tracking, Patch, Third Party Advisory
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7 Patch, Release Notes, Third Party Advisory
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html Third Party Advisory
- https://seclists.org/bugtraq/2019/May/68 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190530-0003/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4452 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html