Description
XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-dataformat-xml | 2.7.4-1 | — |
| Debian 13 | jackson-dataformat-xml | 2.7.4-1 | — |
| Debian 12 | jackson-dataformat-xml | 2.7.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | jackson-dataformat-xml | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.dataformat:jackson-dataformat-xml | < 2.7.4 | 2.7.4 | GHSA-hmq6-frv3-4727 |
Advisories 1
- WID-SEC-2025-2123 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
References
- FEDORA-2016-13b4cae9df vendor-advisory