Description
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jaspersoft | JasperReports Library Community Edition | ≤ 7.0.3 | — |
| Jaspersoft | Jaspersoft Studio Community Edition | ≤ 7.0.3 | — |
| Jaspersoft | JasperReports Server | ≤ 9.0.0 | — |
| Jaspersoft | JasperReports Library Professional | ≤ 9.0.2 | — |
| Jaspersoft | Jaspersoft Studio Professional | ≤ 9.0.2 | — |
| Jaspersoft | JasperReports IO Professional | ≤ 4.0.0 | — |
| Jaspersoft | JasperReports IO At-Scale | ≤ 4.0.0 | — |
| Jaspersoft | JasperReports Web Studio | ≤ 3.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | jasperreports | No fix yet | — |
| Ubuntu 16.04 LTS | jasperreports | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | net.sf.jasperreports:jasperreports | < 7.0.4 | 7.0.4 | GHSA-7c3f-cg9x-f3gr |
Advisories 3
- ICSA-26-092-03 Hitachi Energy Ellipse CISA ICS & IT advisories · Apr 2, 2026
- ICSA-26-008-01 Hitachi Energy Asset Suite CISA ICS & IT advisories · Jan 7, 2026
- WID-SEC-2025-2067 JasPer: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Sep 16, 2025