CVE-2017-4995: Deserialization of Untrusted Data in Spring Security
Summary
CVE-2017-4995: Deserialization of Untrusted Data in Spring Security. Affects org.springframework.security:spring-security-core across 2 version ranges.
>= 4.2.0.RELEASE, < 4.2.3.RELEASE
>= 5.0.0.M1, < 5.0.0.M2
Fixed in 4.2.3.RELEASE or 5.0.0.M2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Security is a powerful and widely used framework for securing Java applications. It provides authentication and authorization capabilities, protecting applications from unauthorized access. The vulnerability identified as CVE-2017-4995 affects versions 4.2.0.RELEASE through 4.2.2.RELEASE of the 'org.springframework.security:spring-security-core' package, as well as version 5.0.0.M1. This vulnerability is related to the deserialization of untrusted data in Spring Security when default typing is enabled in Jackson. Default typing allows Jackson to automatically determine the type of objects during deserialization. However, this feature can be exploited to execute arbitrary code if a malicious actor can control the deserialized data and there is an unknown 'deserialization gadget' present on the classpath.
Vulnerability Detail
The vulnerability arises due to a deserialization vulnerability in Jackson, a popular JSON library used by Spring Security. When default typing is enabled, Jackson can deserialize untrusted data, which may lead to arbitrary code execution. Spring Security configures Jackson with default typing enabled, making it susceptible to this vulnerability. To exploit this vulnerability, three conditions must be met: (1) Spring Security's Jackson support is being used, (2) untrusted data is deserialized using Jackson, and (3) an unknown 'deserialization gadget' that allows code execution is present on the classpath. Jackson provides a blacklisting approach to protect against known 'deserialization gadgets,' but Spring Security should also proactively block unknown gadgets when default typing is enabled.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2.0.RELEASE, < 4.2.3.RELEASE4.2.3.RELEASE -
>= 5.0.0.M1, < 5.0.0.M25.0.0.M2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a workaround is to disable default typing in Jackson. This can be achieved by configuring Jackson to not use default typing when deserializing untrusted data. However, this workaround may require modifications to the codebase and should be thoroughly tested to ensure it does not introduce any other vulnerabilities. Here is an example of how to disable default typing in Jackson:
ObjectMapper objectMapper = new ObjectMapper();
objectMapper.disableDefaultTyping();
Conclusion
The vulnerability identified as CVE-2017-4995 affects versions 4.2.0.RELEASE through 4.2.2.RELEASE and version 5.0.0.M1 of the 'org.springframework.security:spring-security-core' package. It arises due to a deserialization vulnerability in Jackson when default typing is enabled. To mitigate the risk, it is crucial to upgrade to the fixed versions (4.2.3.RELEASE or 5.0.0.M2) or disable default typing in Jackson. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
Spring Security is a powerful framework for securing Java applications. It provides authentication and authorization capabilities, protecting applications from unauthorized access.
Default typing is a feature in Jackson that allows the library to automatically determine the type of objects during deserialization. It can be enabled or disabled based on the requirements of the application.
The deserialization vulnerability in Jackson occurs when untrusted data is deserialized using default typing. This can lead to the execution of arbitrary code if there is an unknown 'deserialization gadget' present on the classpath.
No, this vulnerability is specific to Spring Security when it is configured to use Jackson for deserialization. Other frameworks using Jackson may also be affected if they meet the conditions mentioned in the vulnerability description.
There are no known exploits for this vulnerability at the time of this report. However, it is important to address the vulnerability promptly by upgrading to a fixed version or implementing the recommended workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
