Deserialization of Untrusted Data in Jython (CVE-2016-4000)

Why this deserves its current priority

CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps org.python:jython (maven), org.python:jython (maven), org.python:jython-standalone (maven), org.python:jython-standalone (maven). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
org.python:jythonmaven	<2.7.1b3	2.7.1b3
org.python:jythonmaven	>=0 <2.7.1b3	2.7.1b3
org.python:jython-standalonemaven	<2.7.1b3	2.7.1b3
org.python:jython-standalonemaven	>=0 <2.7.1b3	2.7.1b3

Recommended response

Check inventory. Check lockfiles and deployed manifests for org.python:jython, org.python:jython, org.python:jython-standalone.
Review the reported fix. Update org.python:jython to 2.7.1b3; org.python:jython to 2.7.1b3; org.python:jython-standalone to 2.7.1b3; org.python:jython-standalone to 2.7.1b3 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
May 13, 2022
Evidence: source:osv:source_dates:source-dates:record
Source modified
Nov 12, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Jul 2, 2026

Sources and claim methodology

Upstream source description

Jython before 2.7.1b3 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.

Quoted source text, attributed separately from HOL analysis.

Deserialization of Untrusted Data in JythonCVE-2016-4000