A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica

Summary

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Timeline

1. Feb 6, 2018, 3:00 PM UTCCVE published
2. Oct 8, 2026, 9:05 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 8, 2026, 9:13 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• FasterXML jackson-databind

  before 2.6.7.1, before 2.7.9.1, before 2.8.9

• com.fasterxml.jackson.core:jackson-databindMaven

  fixed in 2.6.7.1

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.7.0 · fixed in 2.7.9.1

• com.fasterxml.jackson.core:jackson-databindMaven

  From 2.8.0 · fixed in 2.8.9

References 25