CVE-2017-15095

jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

9.8 CriticalFix available

CVE-2017-15095 is a critical vulnerability (CVSS 9.8) in Fasterxml Jackson-databind, published November 16, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.36%, the 94th percentile. Fixed in com.fasterxml.jackson.core:jackson-databind 2.9.4.

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

8.36%Down 27.4 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2017-15095
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-184, CWE-502
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-15095
Weakness: CWE-184
Updated: 2026-11-02

EUVDEUVD-2018-0610 No score

Record: EUVD-2018-0610
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h592-38cm-4ggp 9.8

jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

jackson-databind in versions prior to 2.8.11 and 2.9.4 contain a deserialization flaw which allows an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525, blacklisting additonal vulnerable classes.

Record: GHSA-h592-38cm-4ggp
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-184, CWE-502
Updated: 2026-11-02

OSV 9.8

Record: CVE-2017-15095
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-15095 9.8

Record: DEBIAN-CVE-2017-15095
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 16 moreShow less

OSVGHSA-h592-38cm-4ggp 9.8

jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

Record: GHSA-h592-38cm-4ggp
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-184, CWE-502
Updated: 2026-11-02

OSVRHSA-2017:3189 8.1

Red Hat Security Advisory: rh-eclipse47-jackson-databind security update

Record: RHSA-2017:3189
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:3190 8.1

Red Hat Security Advisory: rh-eclipse46-jackson-databind security update

Record: RHSA-2017:3190
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2018:0342 8.1

Red Hat Security Advisory: rh-maven35-jackson-databind security update

Record: RHSA-2018:0342
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2018:0479 8.6

Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 on RHEL 6

Record: RHSA-2018:0479
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2018:0480 8.6

Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 for RHEL 7

Record: RHSA-2018:0480
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2018:0481 8.6

Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.1

Record: RHSA-2018:0481
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2018:1448 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update

Record: RHSA-2018:1448
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2018:1449 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update

Record: RHSA-2018:1449
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2018:1450 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update

Record: RHSA-2018:1450
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2018:1451 8.1

Red Hat Security Advisory: eap6-jboss-ec2-eap security update

Record: RHSA-2018:1451
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2018:2927 8.1

Red Hat Security Advisory: Satellite 6.4 security, bug fix, and enhancement update

Record: RHSA-2018:2927
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-15095 9.8

Record: UBUNTU-CVE-2017-15095
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2017-0408 No score

Updated jackson-databind packages fix security vulnerability

An unsafe deserialization vulnerability was found due to incomplete blacklisting of the unsafe elements, due to an incomplete fix for CVE-2017-7525 (CVE-2017-15095).

Record: MGASA-2017-0408
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2017-15095 No score

CVE-2017-15095 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2017-15095 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2017-15095
Updated: 2026-11-02

OSVUSN-4741-1 No score

libjackson-json-java vulnerabilities

It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code.

Record: USN-4741-1
Updated: 2026-11-02

Affected products

Show 12 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`com.fasterxml.jackson.core:jackson-databind` Maven	2.9.0 up to 2.9.4	2.9.4
`com.fasterxml.jackson.core:jackson-databind` Maven	2.8.0 up to 2.8.11	2.8.11
`com.fasterxml.jackson.core:jackson-databind` Maven	2.0.0 up to 2.6.7.3	2.6.7.3
`com.fasterxml.jackson.core:jackson-databind` Maven	2.7.0 up to 2.7.9.2	2.7.9.2
`jackson-databind` Debian:12	before 2.9.1-1	2.9.1-1
`jackson-databind` Debian:13	before 2.9.1-1	2.9.1-1
`jackson-databind` Debian:14	before 2.9.1-1	2.9.1-1
`libjackson-json-java` Debian:12	before 1.9.13-2	1.9.13-2
`libjackson-json-java` Debian:13	before 1.9.13-2	1.9.13-2
`libjackson-json-java` Debian:14	before 1.9.13-2	1.9.13-2

Show 290 moreShow less

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 622 package rows, 10 versions and 144 references. The JSON record has them. Also not on the record: 274 package claims. ID and package lookups still check them.

Affected packages
Package	Affected	Fixed
`libjackson-json-java` Debian:8	before 1.9.2-3+deb8u1, plus listed versions 1.9.2-3	1.9.2-3+deb8u1
`libjackson-json-java` Debian:9	before 1.9.2-8+deb9u1, plus listed versions 1.9.2-8	1.9.2-8+deb9u1
`jackson-databind` Debian:8	before 2.4.2-2+deb8u2, plus listed versions 2.4.2-22.4.2-2+deb8u1	2.4.2-2+deb8u2
`jackson-databind` Debian:9	before 2.8.6-1+deb9u2, plus listed versions 2.8.6-12.8.6-1+deb9u1	2.8.6-1+deb9u2
`com.fasterxml.jackson.core:jackson-databind` Maven	2.8.0 up to 2.8.11, plus listed versions 2.8.12.8.102.8.22.8.32.8.4 Show 6 moreShow less 2.8.52.8.62.8.72.8.82.8.8.12.8.9	2.8.11
`com.fasterxml.jackson.core:jackson-databind` Maven	2.9.0 up to 2.9.4, plus listed versions 2.9.0.pr12.9.0.pr22.9.0.pr32.9.0.pr42.9.12.9.22.9.3	2.9.4
`com.fasterxml.jackson.core:jackson-databind` Maven	2.0.0 up to 2.6.7.3, plus listed versions 2.0.12.0.22.0.42.0.52.0.6 Show 45 moreShow less 2.1.02.1.12.1.22.1.32.1.42.1.52.2.02.2.0-rc12.2.12.2.22.2.32.2.42.3.02.3.0-rc12.3.12.3.22.3.32.3.42.3.52.4.02.4.0-rc12.4.0-rc22.4.0-rc32.4.12.4.1.12.4.1.22.4.1.32.4.22.4.32.4.42.4.52.4.5.12.4.62.4.6.12.5.02.5.0-rc12.5.12.5.22.5.32.5.42.5.52.6.02.6.0-rc12.6.0-rc22.6.0-rc3	2.6.7.3
`com.fasterxml.jackson.core:jackson-databind` Maven	2.7.0 up to 2.7.9.2, plus listed versions 2.7.12.7.1-12.7.22.7.32.7.4 Show 6 moreShow less 2.7.52.7.62.7.72.7.82.7.92.7.9.1	2.7.9.2
`jackson-databind` Mageia:5	before 2.4.3-4.2.mga5	2.4.3-4.2.mga5
`jackson-databind` Mageia:6	before 2.7.6-1.2.mga6	2.7.6-1.2.mga6
`rh-eclipse47-jackson-databind` Red Hat:devtools:2::el7	before 0:2.7.6-3.3.el7	0:2.7.6-3.3.el7
`rh-eclipse47-jackson-databind-javadoc` Red Hat:devtools:2::el7	before 0:2.7.6-3.3.el7	0:2.7.6-3.3.el7
`rh-eclipse46-jackson-databind` Red Hat:rhel_software_collections:3::el7	before 0:2.6.3-2.4.el7	0:2.6.3-2.4.el7
`rh-eclipse46-jackson-databind-javadoc` Red Hat:rhel_software_collections:3::el7	before 0:2.6.3-2.4.el7	0:2.6.3-2.4.el7
`rh-maven35-jackson-databind` Red Hat:rhel_software_collections:3::el7	before 0:2.7.6-2.4.el7	0:2.7.6-2.4.el7
`rh-maven35-jackson-databind-javadoc` Red Hat:rhel_software_collections:3::el7	before 0:2.7.6-2.4.el7	0:2.7.6-2.4.el7
`eap7-activemq-artemis` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-cli` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-commons` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-core-client` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-dto` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-hornetq-protocol` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-hqclient-protocol` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-jdbc-store` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-jms-client` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-jms-server` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-journal` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-native` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-ra` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-selector` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-server` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-service-extensions` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5.009-1.redhat_1.1.ep7.el6	0:1.5.5.009-1.redhat_1.1.ep7.el6
`eap7-apache-cxf` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:3.1.13-1.redhat_1.1.ep7.el6	0:3.1.13-1.redhat_1.1.ep7.el6
`eap7-apache-cxf-rt` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:3.1.13-1.redhat_1.1.ep7.el6	0:3.1.13-1.redhat_1.1.ep7.el6
`eap7-apache-cxf-services` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:3.1.13-1.redhat_1.1.ep7.el6	0:3.1.13-1.redhat_1.1.ep7.el6
`eap7-apache-cxf-tools` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:3.1.13-1.redhat_1.1.ep7.el6	0:3.1.13-1.redhat_1.1.ep7.el6
`eap7-glassfish-jsf` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:2.2.13-6.SP5_redhat_1.1.ep7.el6	0:2.2.13-6.SP5_redhat_1.1.ep7.el6
`eap7-hibernate` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.1.12-1.Final_redhat_1.1.ep7.el6	0:5.1.12-1.Final_redhat_1.1.ep7.el6
`eap7-hibernate-core` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.1.12-1.Final_redhat_1.1.ep7.el6	0:5.1.12-1.Final_redhat_1.1.ep7.el6
`eap7-hibernate-entitymanager` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.1.12-1.Final_redhat_1.1.ep7.el6	0:5.1.12-1.Final_redhat_1.1.ep7.el6