Loading story…
Jackson applications that deserialize attacker-controlled JSON with insecure polymorphic type handling can be coerced into instantiating dangerous classes. Research tracked as CVE-2019-12384 showed that ch.qos.logback.core.db.DriverManagerConnectionSource can be used as a gadget to initiate attacker-selected JDBC connections, creating server-side request forgery (SSRF) and denial-of-service exposure.
Where the H2 JDBC driver is available, a crafted JDBC URL using H2's INIT=RUNSCRIPT capability can load a remote SQL script and escalate the condition to remote code execution. Jackson's historic reliance on a denylist of known gadget classes means newly identified gadgets may remain exploitable until blocked; organizations should avoid unsafe polymorphic/default typing for untrusted input, update Jackson and dependent Java libraries, and review applications for exposed deserialization endpoints.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Andrea Brancaleoni published Doyensec research describing CVE-2019-12384, in which unsafe Jackson polymorphic deserialization can be exploited with the Logback DriverManagerConnectionSource gadget. The research demonstrated SSRF and denial-of-service effects, with H2's JDBC INIT=RUNSCRIPT feature enabling remote code execution when the H2 driver is available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcegithub.com
Open sourceblog.doyensec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2017-7525** affects Jackson Databind when applications pass attacker-controlled JSON to `ObjectMapper.readValue` while global polymorphic typing has been enabled with `ObjectMapper.enableDefaultTyping()`. Attackers can abuse unsafe gadget types, including `com.sun.rowset.JdbcRowSetImpl` in susceptible dependency environments, to achieve unauthenticated code execution. Jackson also addressed the related **CVE-2017-15095** by expanding restrictions on dangerous JDK types used in polymorphic deserialization; affected fixes targeted versions 2.8.10 and 2.9.1, with a 2.7 backport. Red Hat released updates for numerous products, including JBoss EAP, OpenShift Container Platform, JBoss Data Grid, Fuse, and Software Collections; RHSA-2017:1839 supplied `rh-eclipse46-jackson-databind-2.6.3-2.3.el7` for affected RHEL 7 deployments. Debian later shipped LTS updates for Jessie and Stretch that fixed CVE-2017-7525, CVE-2017-15095, and the Jackson XML XXE flaw **CVE-2019-10172**. Organizations should update affected Jackson packages and avoid globally enabling default typing, using explicit `@JsonTypeInfo` only where type metadata is required. Apache Solr's review found its 7.7 branch did not enable default typing and constrained `@JsonTypeInfo` to named subtypes, reducing exposure to these exploit paths.
Aug 28, 2026
A critical deserialization vulnerability in **Fastjson 1.2.x** allows unauthenticated remote code execution by abusing the library’s internal type-resolution logic, bypassing traditional `autoType` blacklist and whitelist protections without requiring third-party gadget classes on the target system. Public disclosure and proof-of-concept details identified affected versions as **1.2.68 through 1.2.83** when **SafeMode** is disabled, with researchers noting that **Spring Boot fat-jar** classloading can enable attacker-controlled remote class loading over HTTP. Analysis indicates the flaw is most likely to produce full RCE on **JDK 8**, while newer JDK versions may limit impact to **SSRF** in some environments.
Jul 25, 2026
Apache TinkerPop and Apache HBase proposed upgrades to `jackson-databind` 2.9.10 to remediate multiple unsafe polymorphic-deserialization vulnerabilities in earlier Jackson releases. TinkerPop’s update addressed `CVE-2019-14379`, `CVE-2019-14540`, and `CVE-2019-16335`, while aligning related Jackson and Scala dependencies; its Docker build reportedly completed successfully. `CVE-2019-14540` affects Jackson versions before 2.9.10 when polymorphic typing can process the `com.zaxxer.hikari.HikariConfig` class. HBase’s HBASE-23075 update also cited `CVE-2019-16335`, involving `com.zaxxer.hikari.HikariDataSource`, and upgraded Jackson to remove exposure to both vulnerable gadget classes. Organizations using affected TinkerPop or HBase builds should verify that their deployed dependency trees resolve `jackson-databind` to 2.9.10 or a later supported patched release.
Aug 28, 2026