CVE-2019-17531

CVE-2019-17531 is a critical polymorphic typing vulnerability in FasterXML jackson-databind versions 2.0.0 through 2.9.10, affecting products from vendors like Debian, NetApp, Oracle, and Red Hat. This flaw allows remote attackers to execute arbitrary code by leveraging default typing, the presence of apache-log4j-extra (1.2.x) in the classpath, and a malicious JNDI service. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk of complete compromise (confidentiality, integrity, and availability) with low attack complexity and no user interaction required. While there is no evidence of active exploitation or publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.