Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2019-14439: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2

60
This week
HIGH 7.5REMOTEWATCHLISTUPGRADEMITIGATEMITIGATE

CVE-2019-14439 is a high-severity flaw (CVSS 7.5) affecting jackson-databind, debian linux, fedora. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Why this priority

  • High severity
  • EPSS top 4%: very likely to be exploited
  • Remotely exploitable, no login, no user action
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score7.5 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance10.8% (top 4%)
CISA exploited listNo
WeaknessCWE-502
Published2019-07-30
Last modified2026-10-08
Publisher (CNA): MITRE · Vendor: apache · debian · fasterxml · fedoraproject · oracle · redhat

Share: LinkedIn · X · Reddit

Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

fasterxml jackson-databind UPGRADE
Affected: >= 2.0.0 and < 2.6.7.3 · >= 2.7.0 and < 2.7.9.6 · >= 2.8.0 and < 2.8.11.4 · >= 2.9.0 and < 2.9.9.2
Fixed in: 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.2
Safe to downgrade to: a release before 2.0.0
1. Check installed version
apt-cache policy jackson-databind || rpm -q jackson-databind || jackson-databind --version
2. UPGRADE to 2.6.7.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade jackson-databind
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade jackson-databind
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)
apt-cache madison jackson-databind sudo apt install jackson-databind=<VERSION_BEFORE_2.0.0> sudo apt-mark hold jackson-databind
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jackson-databind sudo dnf downgrade jackson-databind-<VERSION_BEFORE_2.0.0> sudo dnf versionlock add jackson-databind
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
debian debian linux MITIGATE
Affected: 8.0 · 9.0 · 10.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
fedoraproject fedora MITIGATE
Affected: 29 · 30
Fixed in: no fixed release known
Safe to downgrade to: a release before 29
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
apache drill DOWNGRADE
Affected: 1.16.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.16.0
1. Check installed version
apt-cache policy drill || rpm -q drill || drill --version
2. No fixed release: DOWNGRADE to a release before 1.16.0 (Debian / Ubuntu)
apt-cache madison drill sudo apt install drill=<VERSION_BEFORE_1.16.0> sudo apt-mark hold drill
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list drill sudo dnf downgrade drill-<VERSION_BEFORE_1.16.0> sudo dnf versionlock add drill
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat jboss middleware text-only advisories DOWNGRADE
Affected: 1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy jboss-middleware-text-only-advisories || rpm -q jboss-middleware-text-only-advisories || jboss-middleware-text-only-advisories --version
2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison jboss-middleware-text-only-advisories sudo apt install jboss-middleware-text-only-advisories=<VERSION_BEFORE_1.0> sudo apt-mark hold jboss-middleware-text-only-advisories
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jboss-middleware-text-only-advisories sudo dnf downgrade jboss-middleware-text-only-advisories-<VERSION_BEFORE_1.0> sudo dnf versionlock add jboss-middleware-text-only-advisories
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle banking platform DOWNGRADE
Affected: 2.4.0 · 2.4.1 · 2.5.0 · 2.6.0 · 2.6.1 · 2.7.0 · 2.7.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.4.0
1. Check installed version
apt-cache policy banking-platform || rpm -q banking-platform || banking-platform --version
2. No fixed release: DOWNGRADE to a release before 2.4.0 (Debian / Ubuntu)
apt-cache madison banking-platform sudo apt install banking-platform=<VERSION_BEFORE_2.4.0> sudo apt-mark hold banking-platform
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list banking-platform sudo dnf downgrade banking-platform-<VERSION_BEFORE_2.4.0> sudo dnf versionlock add banking-platform
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-14439?

jackson-databind: upgrade to 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.2; debian linux: mitigate or apply the listed mitigation; fedora: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2019-14439 being exploited?

CVE-2019-14439 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-14439 affect?

CVE-2019-14439 affects jackson-databind, debian linux, fedora. Severity is high (CVSS 7.5). A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has

How urgent is CVE-2019-14439?

Priority 60/100. High severity; EPSS top 4%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist

Software pages

Debian vulnerabilities · JBoss and WildFly vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.