An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.

Summary

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Timeline

1. Mar 17, 2019, 5:57 PM UTCCVE published
2. Oct 15, 2026, 5:21 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 15, 2026, 5:22 PM UTCRecord last updated

Affected versions

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.7.0 · fixed in 2.7.9.4

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.8.0 · fixed in 2.8.11.2

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.9.0 · fixed in 2.9.6

References 25