As per the file: https://github.com/msgpack/msgpack-java/blob/develop/build.sbt#L118 It looks like msgpack-java is using jackson-databind 2.7.1 which has a known security vulnerability CVE-2017-7525. Ref: https://github.com/FasterXML/jackson-databind/issues/1599 Exploit: https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/ The issue is fixed in 2.8.10. Please update the library.
As per the file: https://github.com/msgpack/msgpack-java/blob/develop/build.sbt#L118
It looks like msgpack-java is using jackson-databind 2.7.1 which has a known security vulnerability CVE-2017-7525.
Ref: FasterXML/jackson-databind#1599
Exploit: https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/
The issue is fixed in 2.8.10. Please update the library.