FasterXML Jackson-databind 2.9.0

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:fasterxml:jackson-databind:2.9.0:-:*:*:*:*:*:*

part: a version: 2.9.0 update: -

VendorFasterxml (ad2f994e-5748-54a8-a922-c0875b2b0045)
ProductJackson Databind (41cba8d8-a87d-5900-8550-ce40bafcfc23)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/fasterxml/jackson-databind purl2cpe 2026-06-01 10:13:08.847170
pkg:maven/com.fasterxml.jackson.core/jackson-databind purl2cpe 2026-06-01 10:13:08.847171
pkg:maven/org.apache.fasterxml.jackson.core/jackson-databind purl2cpe 2026-06-01 10:13:08.847173
pkg:rpm/fedora/jackson-databind purl2cpe 2026-06-01 10:13:08.847174
pkg:rpm/opensuse/jackson-databind purl2cpe 2026-06-01 10:13:08.847176

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2017-15095 vulnerable 2026-06-08 05:08:57.835812 Details available
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Published: 2018-02-06T15:00:00.000Z
Updated: 2026-10-08T21:13:48.206Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.