CVE-2017-17485: Jackson-databind blacklist bypass enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction and a very high EPSS percentile make this a top remediation priority despite no KEV listing.

What it is

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution via an incomplete fix for the CVE-2017-7525 deserialization flaw. Crafted JSON sent to ObjectMapper.readValue bypasses the blacklist when Spring libraries are present on the classpath. This matters because it is a network-reachable, no-authentication deserialization flaw in a widely embedded Java library.

Impact

An attacker can execute arbitrary code in the context of the application running jackson-databind, leading to full compromise of confidentiality, integrity and availability. The CVSS vector rates all three impacts as high.

Attack surface

Reached over the network by sending maliciously crafted JSON to an endpoint that calls ObjectMapper.readValue; the CVSS vector shows no privileges required and no user interaction. Exploitation depends on the Spring libraries being available in the classpath.

Exploitation

Not listed in CISA KEV, but EPSS is 0.49727 (98.84th percentile), indicating high predicted exploitation activity. References are advisory and vendor errata only, with no public exploit tag supplied.

What to do

• Upgrade jackson-databind to a version after 2.9.3 that contains the complete fix for the CVE-2017-7525 blacklist bypass.
• Apply the vendor errata listed for Red Hat, Debian, NetApp, HPE and Oracle products that bundle the affected library.
• Enable Jackson default typing restrictions and avoid enabling polymorphic type handling on untrusted input.
• Remove unnecessary Spring libraries from the classpath where they are not required, since their presence enables the bypass.
• Restrict network access to JSON deserialization endpoints and validate or reject unexpected type identifiers.

Detection

• Monitor application logs and WAF alerts for JSON payloads containing unexpected @class or type identifier fields sent to deserialization endpoints.
• Hunt for outbound connections or process execution spawned by the Java application server shortly after JSON API requests.
• Inventory applications and dependencies for jackson-databind versions 2.8.x through 2.8.10 and 2.9.x through 2.9.3.
• Alert on deserialization errors or class-loading exceptions from ObjectMapper.readValue in application logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.