Loading story…
Apache TinkerPop and Apache HBase proposed upgrades to jackson-databind 2.9.10 to remediate multiple unsafe polymorphic-deserialization vulnerabilities in earlier Jackson releases. TinkerPop’s update addressed CVE-2019-14379, CVE-2019-14540, and CVE-2019-16335, while aligning related Jackson and Scala dependencies; its Docker build reportedly completed successfully.
CVE-2019-14540 affects Jackson versions before 2.9.10 when polymorphic typing can process the com.zaxxer.hikari.HikariConfig class. HBase’s HBASE-23075 update also cited CVE-2019-16335, involving com.zaxxer.hikari.HikariDataSource, and upgraded Jackson to remove exposure to both vulnerable gadget classes. Organizations using affected TinkerPop or HBase builds should verify that their deployed dependency trees resolve jackson-databind to 2.9.10 or a later supported patched release.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
SteNicholas opened HBase pull request #660 under HBASE-23075 to upgrade Jackson in response to jackson-databind polymorphic-typing vulnerabilities CVE-2019-16335 and CVE-2019-14540, affecting versions before 2.9.10.
Justin Chuch opened TinkerPop pull request #1200 to upgrade jackson-databind and related dependencies to 2.9.10, citing CVE-2019-14379, CVE-2019-14540, and CVE-2019-16335. The reported Docker build completed successfully.
iSafeBlue reported a Jackson databind deserialization gadget issue involving HikariConfig through HikariDataSource, later identified as CVE-2019-14540. Jackson listed fixes in versions 2.9.10, 2.8.11.5, and 2.6.7.3; version 2.10.0 and later were not affected.
CVE-2019-14540 was published for a polymorphic-typing issue in FasterXML jackson-databind versions before 2.9.10, involving the com.zaxxer.hikari.HikariConfig class.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
lists.apache.org
Open sourcelists.apache.org
Open sourcegithub.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2017-7525** affects Jackson Databind when applications pass attacker-controlled JSON to `ObjectMapper.readValue` while global polymorphic typing has been enabled with `ObjectMapper.enableDefaultTyping()`. Attackers can abuse unsafe gadget types, including `com.sun.rowset.JdbcRowSetImpl` in susceptible dependency environments, to achieve unauthenticated code execution. Jackson also addressed the related **CVE-2017-15095** by expanding restrictions on dangerous JDK types used in polymorphic deserialization; affected fixes targeted versions 2.8.10 and 2.9.1, with a 2.7 backport. Red Hat released updates for numerous products, including JBoss EAP, OpenShift Container Platform, JBoss Data Grid, Fuse, and Software Collections; RHSA-2017:1839 supplied `rh-eclipse46-jackson-databind-2.6.3-2.3.el7` for affected RHEL 7 deployments. Debian later shipped LTS updates for Jessie and Stretch that fixed CVE-2017-7525, CVE-2017-15095, and the Jackson XML XXE flaw **CVE-2019-10172**. Organizations should update affected Jackson packages and avoid globally enabling default typing, using explicit `@JsonTypeInfo` only where type metadata is required. Apache Solr's review found its 7.7 branch did not enable default typing and constrained `@JsonTypeInfo` to named subtypes, reducing exposure to these exploit paths.
Aug 28, 2026
Jackson applications that deserialize attacker-controlled JSON with insecure polymorphic type handling can be coerced into instantiating dangerous classes. Research tracked as **CVE-2019-12384** showed that `ch.qos.logback.core.db.DriverManagerConnectionSource` can be used as a gadget to initiate attacker-selected JDBC connections, creating server-side request forgery (SSRF) and denial-of-service exposure. Where the H2 JDBC driver is available, a crafted JDBC URL using H2's `INIT=RUNSCRIPT` capability can load a remote SQL script and escalate the condition to remote code execution. Jackson's historic reliance on a denylist of known gadget classes means newly identified gadgets may remain exploitable until blocked; organizations should avoid unsafe polymorphic/default typing for untrusted input, update Jackson and dependent Java libraries, and review applications for exposed deserialization endpoints.
Aug 28, 2026
Apache Commons Collections contained a critical unsafe-deserialization vulnerability, **CVE-2015-7501**, in its serializable `InvokerTransformer` component. An attacker able to supply crafted serialized Java objects to exposed endpoints—including JMX, RMI, or remote EJB services—could chain vulnerable classes with `sun.reflect.annotation.AnnotationInvocationHandler` to execute arbitrary code under the permissions of the affected Java application. The flaw affected Commons Collections 3.0 and 4.0 and exposed products and applications using the library, including WebLogic, WebSphere, JBoss, Jenkins, and OpenNMS. Apache addressed the issue in Commons Collections versions 3.2.2 and 4.1 by preventing `InvokerTransformer` transformations following deserialization. Red Hat also issued a critical update for JBoss Operations Network 3.3.4, directing customers to shut down and patch every server individually, including each node in high-availability deployments. Organizations should identify applications that deserialize untrusted Java objects and either upgrade the library or apply vendor-provided patches.
Aug 29, 2026