A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to…

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Scores

EPSS (exploitation in 30 days)

4.6% · top 8.3% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• n/a
• CWE-502 Deserialization of Untrusted Data (opens in a new tab)All about CWE-502 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavencom.fasterxml.jackson.core:jackson-databindGHSA-f3j5-rmmp-3fc5 (opens in a new tab)

References (20)

• [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2019:3200 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [debian-lts-announce] 20191210 [SECURITY] [DLA 2030-1] jackson-databind security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [druid-commits] 20200115 [druid] branch 0.17.0 updated: Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189) (#9191) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2020:0164 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0159 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0160 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0161 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0445 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [skywalking-dev] 20200324 [CVE-2019-17267] Upgrade jackson-databind version to 2.9.10 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpujul2020.html (opens in a new tab)x_refsource_MISCx_transferred
• https://www.oracle.com/security-alerts/cpujan2020.html (opens in a new tab)x_refsource_MISCx_transferred
• https://security.netapp.com/advisory/ntap-20191017-0006/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/FasterXML/jackson-databind/issues/2460 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10 (opens in a new tab)x_refsource_MISCx_transferred
• [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuoct2020.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-f3j5-rmmp-3fc5 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-17267](https://trackcve.app/badge/CVE-2019-17267.svg)](https://trackcve.app/cve/CVE-2019-17267)

Record last updated 7 Oct 2026, 18:26 UTC.