Synced 18 Jun 2026 05:58 UTC Account
← All products

CVE-2019-14379

CRITICAL severity · CVSS 9.8 · Prototype pollution
9.8CVSS CRITICAL

Summary

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Impact & exploitability

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)8%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

JBoss

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information