CVE-2016-7051: jackson-dataformat-xml vulnerable to server side request forgery (SSRF)
Summary
CVE-2016-7051: jackson-dataformat-xml vulnerable to server side request forgery (SSRF). Affects com.fasterxml.jackson.dataformat:jackson-dataformat-xml across 2 version ranges.
< 2.7.8
>= 2.8.0, < 2.8.4
Fixed in 2.7.8 or 2.8.4, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-dataformat-xml · Debian:11
The same CVE-2016-7051 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-dataformat-xml package is a library for parsing and generating XML data using the Jackson JSON processor. It is commonly used in Java applications to handle XML data. This vulnerability affects versions prior to 2.7.8 and prior to 2.8.4 of the package. The vulnerability allows remote attackers to conduct server-side request forgery (SSRF) attacks by exploiting vectors related to a Document Type Definition (DTD).
Vulnerability Detail
The vulnerability in jackson-dataformat-xml arises from a lack of proper input validation when processing XML data. By crafting malicious XML payloads, an attacker can trick the application into making unintended requests to internal or external resources. This can lead to unauthorized access to sensitive information, remote code execution, or other malicious activities. The vulnerability has a CVSS score of 8.6, indicating a high severity.
How To Fix
Latest published version: 2.22.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.82.7.8 -
>= 2.8.0, < 2.8.42.8.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround is to disable the processing of external entities and DTDs in the XML parser. This can be achieved by configuring the XML parser to disallow the resolution of external entities and disabling DTD processing. The specific steps to implement this workaround may vary depending on the application and XML parser being used.
Conclusion
The jackson-dataformat-xml package is vulnerable to server-side request forgery (SSRF) attacks. It is crucial to upgrade to a fixed version of the package or implement the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.dataformat:jackson-dataformat-xml →
FAQ
jackson-dataformat-xml is a Java library for parsing and generating XML data using the Jackson JSON processor.
Server-side request forgery (SSRF) is a vulnerability that allows an attacker to make requests from the vulnerable server to other internal or external resources, potentially leading to unauthorized access or other malicious activities.
Exploiting this vulnerability can result in unauthorized access to sensitive information, remote code execution, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to a fixed version of the jackson-dataformat-xml package. Alternatively, you can implement the provided workaround to disable the processing of external entities and DTDs in the XML parser.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) or by visiting the Vulert playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.dataformat:jackson-dataformat-xml.
