CVE-2020-14060: Deserialization of untrusted data in Jackson Databind

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-14 · updated 2026-10-08
Weakness: CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

Affected products

FasterXML jackson-databind: from 2.0.0 before 2.9.10.5 — fixed in 2.9.10.5
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
NetApp Steelstore Cloud Integrated Storage: all versions
Oracle Corporation Oracle Agile PLM: 9.3.6
Oracle Corporation Banking Digital Experience: 18.1, 18.2, 18.3, 19.1, 19.2, 20.1
Oracle Communications Calendar Server: 8.0.0.4.0
Oracle Communications Contacts Server: 8.0.0.5.0
Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.2.2
Oracle Communications Element Manager: from 8.2.0 through 8.2.2
Oracle Communications Evolved Communications Application Server: 7.1
Oracle Communications Session Report Manager: from 8.2.0 through 8.2.2
Oracle Communications Session Route Manager: from 8.2.0 through 8.2.2
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.10.5; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+16) — fixed in 2.9.10.5

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.9.10.5; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-14060 or the next vulnerability affects your stack