CriticalFix available
jackson-databind, libjackson-json-java — security advisory
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
- Products
- jackson-databind, libjackson-json-java
- Affected versions
- Not specified
- Fixed versions
- 1.9.13-2, 2.9.1-1
- CVEs
- CVE-2017-15095
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 11:08 UTC · Revision 1
Source evidence
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
osv:DEBIAN-CVE-2017-15095
jackson-databind
Fixed versions: 2.9.1-1
jackson-databind
Fixed versions: 2.9.1-1
jackson-databind
Fixed versions: 2.9.1-1
libjackson-json-java
Fixed versions: 1.9.13-2
libjackson-json-java
Fixed versions: 1.9.13-2
libjackson-json-java
Fixed versions: 1.9.13-2
Complete source record
{
"id": "9fbabf532f4ddfe58257d9f350a27a43bb179c7c3480ad55a9e9b1cd6a67df30",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2017-15095",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2017-15095",
"summary": "A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.",
"evidence": "osv:DEBIAN-CVE-2017-15095",
"products": [
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.9.1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.9.1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.9.1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libjackson-json-java",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.9.13-2",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libjackson-json-java",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.9.13-2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libjackson-json-java",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.9.13-2",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2017-15095",
"aliases": [
"DEBIAN-CVE-2017-15095"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.1-1"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/debian/jackson-databind?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-15095.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.1-1"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/debian/jackson-databind?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-15095.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.1-1"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/debian/jackson-databind?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-15095.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.13-2"
}
]
}
],
"package": {
"name": "libjackson-json-java",
"purl": "pkg:deb/debian/libjackson-json-java?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-15095.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.13-2"
}
]
}
],
"package": {
"name": "libjackson-json-java",
"purl": "pkg:deb/debian/libjackson-json-java?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-15095.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.13-2"
}
]
}
],
"package": {
"name": "libjackson-json-java",
"purl": "pkg:deb/debian/libjackson-json-java?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-15095.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-09T09:47:33.514869641Z",
"provider": "osv",
"upstream": [
"CVE-2017-15095"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2017-15095"
]
},
"related_cves": [
{
"value": "CVE-2017-15095",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 111650,
"published_at": "2018-02-06T15:29:00.233+00:00"
}