CVE-2018-11307

Deserialization of Untrusted Data in jackson-databind

9.8 CriticalFix available

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

5.73%Up 1.3 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2018-11307
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-11307
Updated: 2026-11-02

EUVDEUVD-2019-0602 No score

Record: EUVD-2019-0602
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qr7j-h6gg-jmgc 9.8

Deserialization of Untrusted Data in jackson-databind

Record: GHSA-qr7j-h6gg-jmgc
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 9.8

Record: CVE-2018-11307
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-11307 9.8

Record: DEBIAN-CVE-2018-11307
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 9 moreShow less

OSVGHSA-qr7j-h6gg-jmgc 9.8

Deserialization of Untrusted Data in jackson-databind

Record: GHSA-qr7j-h6gg-jmgc
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVRHSA-2019:0782 8.1

Red Hat Security Advisory: rh-maven35-jackson-databind security update

Record: RHSA-2019:0782
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2019:1107 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 6 security update

Record: RHSA-2019:1107
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2019:1108 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 7 security update

Record: RHSA-2019:1108
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-11307 9.8

Record: UBUNTU-CVE-2018-11307
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1793521537 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (18 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 18 CVEs. Fixed in 2.9.5-tuxcare.2.

Record: CLSA-2026-1793521537
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10868-1 No score

jackson-databind-2.10.5.1-2.2 on GA media

These are all security issues fixed in the jackson-databind-2.10.5.1-2.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10868-1
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2018-11307 No score

CVE-2018-11307 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2018-11307 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2018-11307
Updated: 2026-11-02

OSVUSN-4813-1 No score

jackson-databind vulnerabilities

It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2018-11307, CVE-2019-12086, CVE-2019-12814)

It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code or other unspecified impact. (CVE-2018-12022, CVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362, CVE-2019-12384, CVE-2019-14379, CVE-2019-14439, CVE-2019-14540, CVE-2019-16335, CVE-2019-16942, CVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619, CVE-2020-11620, CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-14195, CVE-2020-8840, CVE-2020-9546, CVE-2020-9547, CVE-2020-9548)

It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute XML entity (XXE) attacks. (CVE-2018-14720)

It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute server-side request forgery (SSRF). (CVE-2018-14721)

Record: USN-4813-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`com.fasterxml.jackson.core:jackson-databind` Maven	2.9.0 up to 2.9.6	2.9.6
`com.fasterxml.jackson.core:jackson-databind` Maven	2.0.0 to 2.7.9.3	2.7.9.4
`com.fasterxml.jackson.core:jackson-databind` Maven	2.8.0 to 2.8.11.1	2.8.11.2
`com.fasterxml.jackson.core:jackson-databind` TuxCare:Maven	2.9.5 up to 2.9.5-tuxcare.2, plus listed versions 2.9.5-tuxcare.1	2.9.5-tuxcare.2
`jackson-databind` Debian:12	before 2.9.8-1	2.9.8-1
`jackson-databind` Debian:13	before 2.9.8-1	2.9.8-1
`jackson-databind` Debian:14	before 2.9.8-1	2.9.8-1
`jackson-databind` Debian:8	before 2.4.2-2+deb8u5, plus listed versions 2.4.2-22.4.2-2+deb8u12.4.2-2+deb8u22.4.2-2+deb8u32.4.2-2+deb8u4	2.4.2-2+deb8u5
`jackson-databind` Debian:9	before 2.8.6-1+deb9u5, plus listed versions 2.8.6-12.8.6-1+deb9u12.8.6-1+deb9u22.8.6-1+deb9u32.8.6-1+deb9u4	2.8.6-1+deb9u5
`com.fasterxml.jackson.core:jackson-databind` Maven	2.0.0 up to 2.7.9.4, plus listed versions 2.0.12.0.22.0.42.0.52.0.6 Show 45 moreShow less 2.1.02.1.12.1.22.1.32.1.42.1.52.2.02.2.0-rc12.2.12.2.22.2.32.2.42.3.02.3.0-rc12.3.12.3.22.3.32.3.42.3.52.4.02.4.0-rc12.4.0-rc22.4.0-rc32.4.12.4.1.12.4.1.22.4.1.32.4.22.4.32.4.42.4.52.4.5.12.4.62.4.6.12.5.02.5.0-rc12.5.12.5.22.5.32.5.42.5.52.6.02.6.0-rc12.6.0-rc22.6.0-rc3	2.7.9.4

Show 290 moreShow less

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-11307 is a critical vulnerability (CVSS 9.8) in Fasterxml Jackson-databind, published March 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.73%, the 93rd percentile. Fixed in com.fasterxml.jackson.core:jackson-databind 2.9.6.

References

Show 187 moreShow less

This page doesn't list everything

Left out here: 36 package rows and 30 versions. The JSON record has them.

Affected packages
Package	Affected	Fixed
`com.fasterxml.jackson.core:jackson-databind` Maven	2.8.0 up to 2.8.11.2, plus listed versions 2.8.12.8.102.8.112.8.11.12.8.2 Show 8 moreShow less 2.8.32.8.42.8.52.8.62.8.72.8.82.8.8.12.8.9	2.8.11.2
`com.fasterxml.jackson.core:jackson-databind` Maven	2.9.0 up to 2.9.6, plus listed versions 2.9.0.pr12.9.0.pr22.9.0.pr32.9.0.pr42.9.1 Show 4 moreShow less 2.9.22.9.32.9.42.9.5	2.9.6
`rh-maven35-jackson-databind` Red Hat:rhel_software_collections:3::el7	before 0:2.7.6-2.5.el7	0:2.7.6-2.5.el7
`rh-maven35-jackson-databind-javadoc` Red Hat:rhel_software_collections:3::el7	before 0:2.7.6-2.5.el7	0:2.7.6-2.5.el7
`eap7-activemq-artemis` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-cli` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-commons` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-core-client` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-dto` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-hornetq-protocol` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-hqclient-protocol` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-jdbc-store` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-jms-client` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-jms-server` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-journal` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-native` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-ra` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-selector` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-server` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-service-extensions` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-activemq-artemis-tools` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-5.redhat_00020.1.el6eap	0:2.6.3-5.redhat_00020.1.el6eap
`eap7-apache-commons-lang` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.8.0-1.redhat_00001.1.el6eap	0:3.8.0-1.redhat_00001.1.el6eap
`eap7-apache-cxf` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.7-1.redhat_00001.1.el6eap	0:3.2.7-1.redhat_00001.1.el6eap
`eap7-apache-cxf-rt` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.7-1.redhat_00001.1.el6eap	0:3.2.7-1.redhat_00001.1.el6eap
`eap7-apache-cxf-services` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.7-1.redhat_00001.1.el6eap	0:3.2.7-1.redhat_00001.1.el6eap
`eap7-apache-cxf-tools` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.7-1.redhat_00001.1.el6eap	0:3.2.7-1.redhat_00001.1.el6eap
`eap7-apache-cxf-xjc-utils` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.3-2.redhat_00002.1.el6eap	0:3.2.3-2.redhat_00002.1.el6eap
`eap7-artemis-native` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-15.redhat_00020.el6eap	0:2.6.3-15.redhat_00020.el6eap
`eap7-artemis-native-wildfly` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.6.3-15.redhat_00020.el6eap	0:2.6.3-15.redhat_00020.el6eap
`eap7-byte-buddy` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.9.5-1.redhat_00001.1.el6eap	0:1.9.5-1.redhat_00001.1.el6eap
`eap7-cxf-xjc-boolean` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.3-2.redhat_00002.1.el6eap	0:3.2.3-2.redhat_00002.1.el6eap
`eap7-cxf-xjc-bug986` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.3-2.redhat_00002.1.el6eap	0:3.2.3-2.redhat_00002.1.el6eap
`eap7-cxf-xjc-dv` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.3-2.redhat_00002.1.el6eap	0:3.2.3-2.redhat_00002.1.el6eap
`eap7-cxf-xjc-runtime` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.3-2.redhat_00002.1.el6eap	0:3.2.3-2.redhat_00002.1.el6eap
`eap7-cxf-xjc-ts` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.2.3-2.redhat_00002.1.el6eap	0:3.2.3-2.redhat_00002.1.el6eap
`eap7-dom4j` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.1.1-2.redhat_00001.1.el6eap	0:2.1.1-2.redhat_00001.1.el6eap
`eap7-elytron-web` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.2.4-1.Final_redhat_00001.1.el6eap	0:1.2.4-1.Final_redhat_00001.1.el6eap
`eap7-hibernate` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:5.3.9-2.Final_redhat_00002.1.el6eap	0:5.3.9-2.Final_redhat_00002.1.el6eap
`eap7-hibernate-core` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:5.3.9-2.Final_redhat_00002.1.el6eap	0:5.3.9-2.Final_redhat_00002.1.el6eap
`eap7-hibernate-entitymanager` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:5.3.9-2.Final_redhat_00002.1.el6eap	0:5.3.9-2.Final_redhat_00002.1.el6eap