CVE-2017-7525

highpriority · attend · 62EPSS 0.377 · 99 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

5 exploits · PoC

Likely / severe?

37.7% (99th) EPSS

CVSS 7.5 · high

Is it mine?

83 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-23

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Fixeddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2017:1840
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-0:2.5.0-2.4.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Workarounddevtoolset-4-jackson-databind-javadoc-0:2.5.0-2.4.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.08.1highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-184USCWE-184USCWE-20USCWE-502USCWE-502USCWE-502US

exploits (5)

Public proof-of-concept and weaponised exploit code.

Dannners/jackson-deserialization-2017-7525Jackson Deserialization CVE-2017-7525 PoCPoC · poc_in_github
Ingenuity-Fainting-Goats/CVE-2017-7525-Jackson-Deserialization-LabInsecure Java Deserialization LabPoC · poc_in_github
JavanXD/Demo-Exploit-Jackson-RCEExploiting CVE-2017-7525 demo project with Angular7 frontend and Spring.PoC · poc_in_github
Nazicc/S2-055CVE-2017-7525 S2-055 ExploitPoC · poc_in_github
SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告PoC · poc_in_github

affected products (83)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
IBM InfoSphere Information Serverall versionscert_bundDEcpe:/a:ibm:infosphere_information_server:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat JBoss Enterprise Application Platform 7all versionscert_bundDEcpe:/a:redhat:jboss_enterprise_application_platform:7
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
FasterXML jackson-databind≤ before 2.8.9enisa_euvdEU
FasterXML jackson-databind≤ before 2.7.9.1enisa_euvdEU
FasterXML jackson-databind≤ before 2.6.7.1enisa_euvdEU
FasterXML, LLC Jackson-databind2.6.0 → 2.6.7.1fstec_bduRU
FasterXML, LLC Jackson-databind2.7.0 → 2.7.9.1fstec_bduRU
FasterXML, LLC Jackson-databind2.8.0 → 2.8.9fstec_bduRU
FasterXML, LLC Jackson-databind2.9.0.prerelease1 → 2.9.0.prerelease2fstec_bduRU
АО «Концерн ВНИИНС» ОС ОН «Стрелец»≤ 16.01.2023fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.5fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Common Edition≤ 2.12 «Орёл»fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 9fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 8fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
debian debian linux= 8.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
debian debian linux= 9.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*

showing 20 of 83

advisories (6)

Vendor and ecosystem advisories describing this.

RHSA-2017:1840Red Hat Security Advisory: devtoolset-4-jackson-databind security update2017-07-31csaf · redhat_csafUS
An update for devtoolset-4-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2022-1375JFrog Artifactory: Mehrere SchwachstellenDeutsch2022-09-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
WID-SEC-W-2025-1212Oracle Communications Applications: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.
WID-SEC-W-2026-2752Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des DienstesDeutsch2017-07-31csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.
GHSA-qxxx-2pp7-5hmxjackson-databind is vulnerable to a deserialization flaw2018-10-16ghsa · osvUS
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd redhat_csaf osv NVD CVE.org MITRE

published 2018-02-06modified 2026-06-17

references (206)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan