CVE-2019-12086A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.
Updated under an hour ago ()
Does this affect you?
It affects fasterxml jackson-databind and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
fasterxml jackson-databind fasterxml:jackson-databind | from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.7.9.6; from 2.8.0 before 2.8.11.4; from 2.9.0 before 2.9.9 | NVD |
debian debian_linux debian:debian_linux | 8.0; 9.0 | NVD |
References
- https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2%40%3Creviews.spark.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.debian.org/debian-lts-announce/2019/05/msg00030.htmlmailing-list, x-refsource-mlist
- https://www.debian.org/security/2019/dsa-4452vendor-advisory, x-refsource-debian
- https://seclists.org/bugtraq/2019/May/68mailing-list, x-refsource-bugtraq
- http://www.securityfocus.com/bid/109227vdb-entry, x-refsource-bid
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/vendor-advisory, x-refsource-fedora
- https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/vendor-advisory, x-refsource-fedora
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/vendor-advisory, x-refsource-fedora
- https://access.redhat.com/errata/RHSA-2019:2858vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:2937vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:2935vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:2936vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:2938vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:2998vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:3044vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:3045vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:3050vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:3046vendor-advisory, x-refsource-redhat
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Emailing-list, x-refsource-mlist
- https://access.redhat.com/errata/RHSA-2019:3149vendor-advisory, x-refsource-redhat
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Emailing-list, x-refsource-mlist
- https://access.redhat.com/errata/RHSA-2019:3200vendor-advisory, x-refsource-redhat
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3Emailing-list, x-refsource-mlist
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.