--- id: CVE-2018-7489 title: >- FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw summary: >- FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending … severity: critical cvss: 9.8 cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-184 - CWE-502 vendor: fasterxml product: jackson-databind affected: - jackson-databind < 2.7.9.3 - 'jackson-databind >= 2.8.0, < 2.8.11.1' - 'jackson-databind >= 2.9.0, < 2.9.5' - debian_linux = 8.0 - debian_linux = 9.0 - communications_billing_and_revenue_management = 7.5 - communications_billing_and_revenue_management = 12.0 - communications_instant_messaging_server = 10.0.1 - jboss_enterprise_application_platform = 6.4.19 - jboss_enterprise_application_platform = 7.1.2 patched: - jackson-databind 2.9.5 published: '2018-02-26' updated: '2026-10-15' sourceUpdated: '2026-10-15T18:17:20.297' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-7489' references: - url: >- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html label: cve@mitre.org - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html label: cve@mitre.org - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html label: cve@mitre.org - url: 'http://www.securityfocus.com/bid/103203' label: cve@mitre.org - url: 'http://www.securitytracker.com/id/1040693' label: cve@mitre.org - url: 'http://www.securitytracker.com/id/1041890' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:1447' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:1448' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:1449' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:1450' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:1451' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:1786' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:2088' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:2089' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:2090' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:2938' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2018:2939' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:2858' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:3149' label: cve@mitre.org - url: 'https://github.com/FasterXML/jackson-databind/issues/1931' label: cve@mitre.org - url: >- https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20180328-0001/' label: cve@mitre.org - url: >- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us label: cve@mitre.org - url: 'https://www.debian.org/security/2018/dsa-4190' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: cve@mitre.org - url: >- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html label: cve@mitre.org - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: cve@mitre.org - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: cve@mitre.org - url: >- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/103203' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1040693' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1041890' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1447' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1448' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1449' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1450' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1451' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1786' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:2088' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:2089' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:2090' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:2938' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:2939' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:2858' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:3149' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/FasterXML/jackson-databind/issues/1931' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20180328-0001/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2018/dsa-4190' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - cve.org - exploit-available ssvc: exploitation: none automatable: 'yes' technicalImpact: total timestamp: '2026-10-15T17:43:05.463268Z' epss: 0.19781 epssPercentile: 0.97385 exploits: github: 1 githubRepos: - 'https://github.com/tafamace/CVE-2018-7489' checkedAt: '2026-10-20T07:28:01.124Z' exploitAvailable: true ingestedAt: '2026-10-15T18:23:58.392Z' --- ## Overview FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. ## Affected - `jackson-databind < 2.7.9.3` - `jackson-databind >= 2.8.0, < 2.8.11.1` - `jackson-databind >= 2.9.0, < 2.9.5` - `debian_linux = 8.0` - `debian_linux = 9.0` - `communications_billing_and_revenue_management = 7.5` - `communications_billing_and_revenue_management = 12.0` - `communications_instant_messaging_server = 10.0.1` - `jboss_enterprise_application_platform = 6.4.19` - `jboss_enterprise_application_platform = 7.1.2` ## Remediation Upgrade past the affected range: - `jackson-databind 2.9.5`