CVE-2019-14893 Polymorphic deserialization of malicious object in jackson-databind
Attackers can execute arbitrary code via unsafe polymorphic deserialization in jackson-databind when default typing or specific type info annotations are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14893?
CVE-2019-14893 is a high-severity unsafe deserialization vulnerability in Fasterxml Jackson-Databind, published on 2 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
Which versions are affected by CVE-2019-14893?
2 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | From 2.9.0 | 2.9.10 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.9.0 | 2.9.10 |
Products include Fasterxml Jackson-Databind, Netapp Oncommand Api Services, Netapp Steelstore Cloud Integrated Storage, Oracle Goldengate Stream Analytics.
How do I fix CVE-2019-14893?
Upgrade com.fasterxml.jackson.core:jackson-databind to 2.9.10 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-14893 being exploited?
There is no known exploitation of CVE-2019-14893 in the wild and no public exploit code.
Other vulnerabilities in Fasterxml Jackson-Databind
- CVE-2018-11307 Deserialization of Untrusted Data in jackson-databind
- CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
- CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- CVE-2020-14060 Deserialization of untrusted data in Jackson Databind
- CVE-2021-46877 jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
Sources
Also known as CLEANSTART-2026-JS33298, DEBIAN-CVE-2019-14893, GHSA-qmqc-x3r4-6v39, ROOT-APP-MAVEN-CVE-2019-14893, UBUNTU-CVE-2019-14893.