SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache

Summary

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Timeline

1. Jul 29, 2019, 11:42 AM UTCCVE published
2. Oct 8, 2026, 8:57 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 8, 2026, 9:03 PM UTCRecord last updated

Affected versions

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.9.0 · fixed in 2.9.9.2

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.8.0 · fixed in 2.8.11.4

• com.fasterxml.jackson.core:jackson-databindMaven

  fixed in 2.7.9.6

References 25