CVE-2016-7051

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-04-14 · updated 2026-06-17
Weakness: CWE-611

Description

XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

Affected products

FasterXML Jackson-Dataformat-Xml: before 2.7.8; 2.8.0, 2.8.0-rc1, 2.8.0-rc2, 2.8.1, 2.8.2, 2.8.3 — fixed in 2.7.8

How to fix

Upgrade to a fixed version: FasterXML Jackson-Dataformat-Xml 2.7.8. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/97688
https://bugzilla.redhat.com/show_bug.cgi?id=1378673
https://github.com/FasterXML/jackson-dataformat-xml/issues/211
http://www.securityfocus.com/bid/97688
https://bugzilla.redhat.com/show_bug.cgi?id=1378673
https://github.com/FasterXML/jackson-dataformat-xml/issues/211

Get alerted when CVE-2016-7051 or the next vulnerability affects your stack