CVE-2020-10650: jackson-databind vulnerable to unsafe deserialization

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-26 · updated 2026-06-17
Weakness: CWE-502

Description

A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.

Affected products

Debian Linux: 10.0
FasterXML jackson-databind: before 2.9.10.4; 2.10.0-prerelease1, 2.10.0-prerelease2, 2.10.0-prerelease3 — fixed in 2.9.10.4
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
Oracle Corporation Retail Merchandising System: 15.0
Oracle Retail Sales Audit: 14.1
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: before 2.9.10.4; 2.0.0, 2.0.0-RC1, 2.0.0-RC2, 2.0.0-RC3, 2.0.1, 2.0.2 (+124) — fixed in 2.9.10.4

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.9.10.4; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-10650 or the next vulnerability affects your stack