Improper Input Validation in jackson-databind

Original summary

Normalized public record · Updated Oct 23, 2026

Improper Input Validation in jackson-databind

Publisher and source text is retained separately from QFinch interpretation.

Affected products

Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.

Remediation

Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.

1. Confirm the affected product and reachable code path exist in your environment.
2. Apply the vendor-supported patch or mitigation from the primary advisory.
3. Rescan the exact deployed revision and retain verification evidence.

Evidence coverage

SSVC priority

MEDIUM

Confidence

20%

Aliases

GHSA-f3j5-rmmp-3fc5

Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.

Sources and record history

1. [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities ↗
2. [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities ↗
3. [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities ↗
4. RHSA-2019:3200 ↗
5. [debian-lts-announce] 20191210 [SECURITY] [DLA 2030-1] jackson-databind security update ↗
6. [druid-commits] 20200115 [druid] branch 0.17.0 updated: Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189) (#9191) ↗
7. RHSA-2020:0164 ↗
8. RHSA-2020:0159 ↗
9. RHSA-2020:0160 ↗
10. RHSA-2020:0161 ↗
11. RHSA-2020:0445 ↗
12. [skywalking-dev] 20200324 [CVE-2019-17267] Upgrade jackson-databind version to 2.9.10 ↗

Record history

Published Oct 6, 2019 · Last refreshed Oct 23, 2026