CVE-2019-10172 in jackson-mapper-asl
Summary
by MITRE
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/11/2026
The vulnerability identified as CVE-2019-10172 represents a critical XML external entity processing flaw within the org.codehaus.jackson:jackson-mapper-asl library version 1.9.x series. This issue shares similarities with CVE-2016-3720, which previously affected the same codehaus library but manifested in different code classes, indicating a persistent architectural weakness in the library's XML parsing implementation. The vulnerability resides in the library's handling of external entity references during XML document processing, creating potential attack vectors that could be exploited by malicious actors.
The technical flaw stems from inadequate input validation and insufficient restrictions on external entity resolution within the jackson-mapper-asl library. When the library processes XML documents containing external entity references, it fails to properly sanitize or restrict these references, allowing attackers to craft malicious XML payloads that can trigger various security impacts. This vulnerability operates at the application level and can be classified under CWE-611, which specifically addresses Improper Restriction of XML External Entity Reference. The flaw essentially permits an attacker to influence how XML documents are parsed and processed, potentially leading to unauthorized data access, server-side request forgery, or denial of service conditions.
The operational impact of this vulnerability extends beyond simple data exposure, as it can enable attackers to perform server-side request forgery attacks where the vulnerable application may be tricked into making unintended network requests to internal systems. This creates significant risk for organizations using affected versions of the library, particularly in environments where XML processing is common or where applications process untrusted input from external sources. The vulnerability affects systems that rely on the jackson-mapper-asl library for XML processing, potentially compromising the integrity and confidentiality of data processing workflows. Attackers could leverage this flaw to access internal network resources, exfiltrate sensitive information, or disrupt service availability through resource exhaustion attacks.
Mitigation strategies for CVE-2019-10172 should prioritize immediate library version updates to patched releases or migration to more modern JSON processing libraries such as the newer jackson-databind library. Organizations must conduct comprehensive inventory assessments to identify all systems using affected library versions and implement proper input validation controls. Security teams should consider implementing network segmentation and monitoring to detect potential exploitation attempts. Additionally, the implementation of XML parser configurations that disable external entity resolution and DTD processing can serve as temporary protective measures. This vulnerability aligns with ATT&CK technique T1213, which covers Data from Information Repositories, and T1071, which covers Application Layer Protocol, highlighting the need for layered defensive approaches. The remediation process should include thorough testing of updated libraries to ensure compatibility with existing applications while maintaining security posture against similar vulnerabilities in the broader Jackson library ecosystem.