CVE-2018-19361

CriticalCVSS 9.8

Published: 02/01/2019(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

10.60%

96th percentile - higher than 96% of all known CVEs

Summary

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

Risk Assessment

Failure to block the openjpa class in polymorphic deserialization may allow an attacker to leverage this class for undesired actions, the exact scope of which is unspecified. This could lead to a breach of confidentiality, integrity, or availability of the system.

Recommendation

Update jackson-databind to version 2.9.8 or later, which blocks the openjpa class from polymorphic deserialization. If updating is not possible, consider implementing additional input validation mechanisms.

Other vulnerabilities in FasterXML jackson-databind

See all

Original NVD description (English source)

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS