CVE-2025-10492: JasperReports Java Deserialization Vulnerability
Summary
CVE-2025-10492: JasperReports has a Java deserialisation vulnerability. Affects net.sf.jasperreports:jasperreports versions < 7.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JasperReports is a popular open-source reporting library that enables developers to create dynamic reports and visualizations from various data sources. It is widely used in Java applications for generating reports in formats such as PDF, HTML, and Excel. The library's flexibility and extensive features make it a go-to choice for many developers. However, a critical vulnerability has been identified that affects versions up to 7.0.3, which could allow attackers to execute arbitrary code remotely due to improper handling of externally supplied data.
Vulnerability Detail
A Java deserialization vulnerability has been discovered in the Jaspersoft Library. This vulnerability arises from the library's failure to properly validate and handle serialized data from untrusted sources. Attackers can exploit this flaw to craft malicious payloads that, when deserialized by the application, can lead to remote code execution. The implications of this vulnerability are severe, as it can compromise the integrity and confidentiality of the affected systems, allowing unauthorized access and control.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation and sanitization to mitigate the risk of deserialization attacks. Additionally, restrict the deserialization of objects to trusted sources only.
Conclusion
The Java deserialization vulnerability in JasperReports poses a significant risk to applications using affected versions of the library. It is crucial for developers to update to the latest version to mitigate this risk. Additionally, implementing workarounds can provide temporary protection until an upgrade can be performed.
See every vulnerability recorded for net.sf.jasperreports:jasperreports →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
Versions of JasperReports up to and including 7.0.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to gain unauthorized access and control over affected systems.
If immediate upgrading is not possible, implement input validation and restrict deserialization to trusted sources as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for net.sf.jasperreports:jasperreports.
