What’s Vulnerable › Vulnerabilities
CVE-2020-35490: Serialization gadgets exploit in jackson-databind
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-12-17 · updated 2026-10-08
- Weakness: CWE-502
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
Affected products
- Debian Linux: 9.0
- FasterXML jackson-databind: from 2.0.0 before 2.9.10.8 — fixed in 2.9.10.8
- NetApp Service Level Manager: all versions
- Oracle Corporation Oracle Agile PLM: 9.3.6
- Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
- Oracle Autovue For Agile Product Lifecycle Management: 21.0.2
- Oracle Banking Platform: 2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0
- Oracle Corporation Banking Treasury Management: 14.4
- Oracle Corporation Banking Virtual Account Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Blockchain Platform: through 21.1.2
- Oracle Communications Cloud Native Core Policy: 1.14.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.4.0
- Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.5.0
- Oracle Communications Evolved Communications Application Server: 7.1
- Oracle Communications Instant Messaging Server: 10.0.1.5.0
- Oracle Corporation Communications Interactive Session Recorder: 6.3, 6.4
- Oracle Communications Offline Mediation Controller: 12.0.0.3
- Oracle Corporation Communications Pricing Design Center: 12.0.0.4.0
- Oracle Communications Services Gatekeeper: 7.0
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.1
- Oracle Documaker: 12.6.3, 12.6.4
- Oracle Insurance Policy Administration J2Ee: 11.2.0
- Oracle Corporation Retail Merchandising System: 15.0.3
- Oracle Corporation Retail Xstore Point of Service: 16.0.6, 17.0.4, 18.0.3, 19.0.2
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
- Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.0.0 before 2.9.10.8; 2.0.0, 2.0.1, 2.0.2, 2.0.4, 2.0.5, 2.0.6 (+125) — fixed in 2.9.10.8
How to fix
Upgrade to a fixed version: FasterXML jackson-databind 2.9.10.8; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.8. Check the vendor advisory for mitigations.
References
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/2986
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- https://security.netapp.com/advisory/ntap-20210122-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/2986
Get alerted when CVE-2020-35490 or the next vulnerability affects your stack