CVE-2019-14439

HighCVSS 7.5

Published: 30/07/2019(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

10.56%

96th percentile - higher than 96% of all known CVEs

Summary

FasterXML jackson-databind 2.x before 2.9.9.2 has a polymorphic typing issue. This occurs when Default Typing is enabled (globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Risk Assessment

Potential remote code execution or unauthorized data access due to improper deserialization of JSON data.

Recommendation

Update jackson-databind to version 2.9.9.2 or later, and consider disabling default typing if not required.

Other vulnerabilities in FasterXML jackson-databind

See all

Original NVD description (English source)

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS