CVE-2017-15095

9.8 criticalEPSS 8.4%

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

CVSS 3.1: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 8.4% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-25)
CWEs: CWE-502, CWE-184
Published: 2018-02-06
Modified: 2026-10-08
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fasterxml:jackson-databind
netapp:oncommand_balance
netapp:oncommand_performance_manager
netapp:oncommand_shift
netapp:snapcenter
oracle:banking_platform
oracle:clusterware
oracle:communications_billing_and_revenue_management
oracle:communications_diameter_signaling_router
oracle:communications_instant_messaging_server
oracle:database_server
oracle:enterprise_manager_for_virtualization
oracle:financial_services_analytical_applications_infrastructure
oracle:global_lifecycle_management_opatchauto
oracle:identity_manager
oracle:jd_edwards_enterpriseone_tools
oracle:primavera_unifier
oracle:utilities_advanced_spatial_and_operational_analytics
oracle:webcenter_portal
redhat:jboss_enterprise_application_platform
redhat:openshift_container_platform
redhat:satellite
redhat:satellite_capsule

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-h592-38cm-4ggp	Maven	com.fasterxml.jackson.core:jackson-databind	>=2.8.0 <2.8.11	2.8.11
GHSA-h592-38cm-4ggp	Maven	com.fasterxml.jackson.core:jackson-databind	>=2.9.0 <2.9.4	2.9.4
GHSA-h592-38cm-4ggp	Maven	com.fasterxml.jackson.core:jackson-databind	>=2.0.0 <2.6.7.3	2.6.7.3
GHSA-h592-38cm-4ggp	Maven	com.fasterxml.jackson.core:jackson-databind	>=2.7.0 <2.7.9.2	2.7.9.2

References

Check your stack JSON