CVE-2016-3720: Fasterxml Jackson-Dataformat-XML

Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days.

XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.

Affected products

• Fasterxml Jackson-Dataformat-XML: up to and including 2.7.3
• Fedoraproject Fedora: version 24 only

Published 2016-06-10. Last modified 2026-06-17.