CVE-2020-35728: Serialization gadget exploit in jackson-databind

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-27 · updated 2026-08-25
Weakness: CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Affected products

Debian Linux: 9.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.5; from 2.7.0 before 2.9.10.8 — fixed in 2.6.7.5, 2.9.10.8
NetApp Service Level Manager: all versions
Oracle Corporation Oracle Agile PLM: 9.3.6
Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
Oracle Corporation AutoVue 3D Professional Advanced: 21.0.2
Oracle Banking Corporate Lending Process Management: 14.2, 14.3, 14.5
Oracle Banking Credit Facilities Process Management: 14.2, 14.3, 14.5
Oracle Banking Extensibility Workbench: 14.2, 14.3, 14.5
Oracle Banking Supply Chain Finance: 14.2, 14.3, 14.5
Oracle Corporation Banking Treasury Management: 14.4
Oracle Corporation Banking Virtual Account Management: 14.2.0, 14.3.0, 14.5.0
Oracle Blockchain Platform: through 21.1.2
Oracle Corporation Oracle Commerce Platform: from 11.3.0 through 11.3.2; 11.2.0
Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
Oracle Communications Cloud Native Core Policy: 1.14.0
Oracle Communications Cloud Native Core Unified Data Repository: 1.4.0
Oracle Corporation Oracle Communications Convergent Charging Controller: 12.0.4.0.0
Oracle Communications Diameter Signaling Route: from 8.0.0.0 through 8.5.0.0
Oracle Communications Element Manager: from 8.2.0.0 through 8.2.4.0
Oracle Communications Evolved Communications Application Server: 7.1
Oracle Communications Network Charging And Control: 12.0.4.0.0
Oracle Corporation Communications Policy Management: 12.5.0
Oracle Communications Services Gatekeeper: 7.0
Oracle Communications Session Report Manager: from 8.0.0.0 through 8.2.2.1
Oracle Communications Session Route Manager: from 8.2.0.0 through 8.2.2.1
Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.1
Oracle Corporation Oracle Data Integrator: 12.2.1.4.0
Oracle Goldengate Application Adapters: 19.1.0.0.0
Oracle Insurance Policy Administration: from 11.1.0 through 11.3.0; 11.0.2

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.5, 2.9.10.8; Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.5.3; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.5.3; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-35728 or the next vulnerability affects your stack