ZeroDay Findings
Sign inSign up

Findings

CVE-2018-14720

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes f…

Published Jan 2, 2019 · updated Oct 15, 2026 · fasterxml jackson-databind

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 2, 2019 · NIST NVD

    Detected

    FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

  2. Oct 15, 2026 · NIST NVD

    Updated

    FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Affected

  • cpe debian/debian linux8.0
  • cpe fasterxml/jackson-databindversion unspecified
  • cpe fasterxml/jackson-databind2.7.0
  • cpe fasterxml/jackson-databind2.8.0
  • cpe oracle/banking platform2.5.0
  • cpe redhat/jboss enterprise application platform7.2.0

Sources

  • CVE.orgVulnerability recordCVE-2018-14720

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2018-14720

    FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

    nvd.nist.gov

References