{"id":"CVE-2025-10492","aliases":["CLSA-2026-1774570930","CLSA-2026-1777941832","CLSA-2026-1778460289","EUVD-2025-29627","GHSA-7c3f-cg9x-f3gr","UBUNTU-CVE-2025-10492"],"status":"published","title":"Jaspersoft Library Deserialisation Vulnerability","description":"A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00922,"percentile":0.60839,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2025-09-16T16:41:44Z","modified":"2026-11-02T19:45:16Z","fixes":[{"ecosystem":"Maven","package":"net.sf.jasperreports:jasperreports","fixed_in":["7.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"net.sf.jasperreports:jasperreports","fixed_in":["6.21.5-tuxcare.1","6.2.2-tuxcare.1","3.7.4-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.sf.jasperreports:jasperreports","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"net.sf.jasperreports:jasperreports","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.21.5"},{"fixed":"6.21.5-tuxcare.1"}]}],"versions":["6.21.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"net.sf.jasperreports:jasperreports","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.1"}]}],"versions":["6.2.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"net.sf.jasperreports:jasperreports","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.4"},{"fixed":"3.7.4-tuxcare.1"}]}],"versions":["3.7.4"]},{"source":"osv","ecosystem":"Maven","package":"net.sf.jasperreports:jasperreports","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4"}]}],"versions":["3.6.0","3.6.1","3.6.2","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","4.0.0","4.0.1","4.0.2","4.1.1","4.1.2","4.1.3","4.5.0","4.5.1","4.6.0","4.7.0","4.7.1","4.8.0","5.0.0","5.0.1","5.0.4","5.1.0","5.1.2","5.2.0","5.5.0","5.5.1","5.5.2","5.6.0","5.6.1","6.0.0","6.0.2","6.0.3","6.0.4","6.1.0","6.1.1","6.10.0","6.11.0","6.12.0","6.12.1","6.12.2","6.13.0","6.14.0","6.15.0","6.16.0","6.17.0","6.18.0","6.18.1","6.19.0","6.19.1","6.2.0","6.2.1","6.2.2","6.20.0","6.20.1","6.20.2","6.20.3","6.20.4","6.20.5","6.20.6","6.21.0","6.21.2","6.21.3","6.21.4","6.21.5","6.3.0","6.3.1","6.4.0","6.4.1","6.4.3","6.5.0","6.5.1","6.6.0","6.7.0","6.7.1","6.8.0","6.8.1","6.9.0","7.0.0","7.0.1","7.0.2","7.0.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jasperreports","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.3+dfsg-3","6.1.1+dfsg-1","6.1.1+dfsg-2","6.1.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jasperreports","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2-3","6.2.2-5","6.3.1-1"]}],"products":[{"vendor":"cloud","product":"jasperreports_io"},{"vendor":"cloud","product":"jasperreports_library"},{"vendor":"cloud","product":"jasperreports_server"},{"vendor":"cloud","product":"jasperreports_studio"},{"vendor":"cloud","product":"jasperreports_web_studio"},{"vendor":"jaspersoft","product":"jasperreports io at-scale"},{"vendor":"jaspersoft","product":"jasperreports io professional"},{"vendor":"jaspersoft","product":"jasperreports library community edition"},{"vendor":"jaspersoft","product":"jasperreports library professional"},{"vendor":"jaspersoft","product":"jasperreports server"},{"vendor":"jaspersoft","product":"jasperreports web studio"},{"vendor":"jaspersoft","product":"jaspersoft studio community edition"},{"vendor":"jaspersoft","product":"jaspersoft studio professional"}],"references":[{"url":"https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6/","tags":["Vendor Advisory"]},{"url":"https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10492","tags":["advisory"]},{"url":"https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6","tags":["web"]},{"url":"https://github.com/Jaspersoft/jasperreports/issues/542","tags":["web"]},{"url":"https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647","tags":["web"]},{"url":"https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7c3f-cg9x-f3gr"},{"url":"https://github.com/Jaspersoft/jasperreports","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-10492","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10492","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-10492","title":"Jaspersoft Library Deserialisation Vulnerability","description":"A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library","status":"published","published":"2025-09-16T16:41:44.931Z","modified":"2026-02-10T18:12:20.433Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-502","CWE-502"],"updated_at":"2026-11-02T14:32:30.643267Z"}],"euvd":[{"id":"EUVD-2025-29627","description":"A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library","status":"published","published":"2025-09-16T16:41:44Z","modified":"2026-02-10T18:12:20Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:48:41.699812Z"}],"ghsa":[{"id":"GHSA-7c3f-cg9x-f3gr","title":"JasperReports has a Java deserialisation vulnerability","description":"A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.","status":"published","published":"2025-09-16T18:31:27Z","modified":"2026-03-09T21:51:01Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:33.538417Z"}],"nvd":[{"id":"CVE-2025-10492","description":"A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library","status":"published","published":"2025-09-16T17:15:40.517Z","modified":"2026-06-17T08:28:25.687Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:11:29.650057Z"}],"osv":[{"id":"GHSA-7c3f-cg9x-f3gr","title":"JasperReports has a Java deserialisation vulnerability","description":"A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.","status":"published","published":"2025-09-16T18:31:27Z","modified":"2026-03-09T22:01:24.684716Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2025-10492","description":"A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library","status":"published","published":"2025-09-16T17:15:00Z","modified":"2025-10-24T05:16:35Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"CLSA-2026-1774570930","title":"TuxCare security update for net.sf.jasperreports:jasperreports (1 CVE)","description":"TuxCare rebuilt net.sf.jasperreports:jasperreports to address 1 CVE. Fixed in 6.21.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-11-02T19:45:16.797940697Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1777941832","title":"TuxCare security update for net.sf.jasperreports:jasperreports (1 CVE)","description":"TuxCare rebuilt net.sf.jasperreports:jasperreports to address 1 CVE. Fixed in 6.2.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:46:28.690494436Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778460289","title":"TuxCare security update for net.sf.jasperreports:jasperreports (1 CVE)","description":"TuxCare rebuilt net.sf.jasperreports:jasperreports to address 1 CVE. Fixed in 3.7.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:46:30.173249954Z","updated_at":"2026-11-02T15:43:44.737408Z"}]}}