CVE-2020-36518: Deeply nested json in jackson-databind

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-11 · updated 2026-06-17
Weakness: CWE-787

Description

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

Affected products

Debian Linux: 9.0, 10.0, 11.0
FasterXML jackson-databind: before 2.12.6.1; from 2.13.0 before 2.13.2.1 — fixed in 2.12.6.1, 2.13.2.1
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Cloud Insights Acquisition Unit: all versions
OnCommand Insight: all versions
NetApp OnCommand Workflow Automation: all versions
NetApp Snap Creator Framework: all versions
Oracle Big Data Spatial And Graph: before 23.1 — fixed in 23.1
Oracle Corporation Oracle Coherence: 14.1.1.0.0
Oracle Corporation Oracle Commerce Platform: 11.3.0, 11.3.1, 11.3.2
Oracle Corporation Communications Billing and Revenue Management: from 12.0.0.4.0 through 12.0.0.6.0
Oracle Communications Cloud Native Core Binding Support Function: 22.1.3
Oracle Communications Cloud Native Core Console: 1.9.0
Oracle Communications Cloud Native Core Network Repository Function: 22.1.2, 22.2.0
Oracle Communications Cloud Native Core Network Slice Selection Function: 22.1.0, 22.1.1
Oracle Communications Cloud Native Core Security Edge Protection Proxy: 22.1.1
Oracle Communications Cloud Native Core Service Communication Proxy: 22.2.0
Oracle Communications Cloud Native Core Unified Data Repository: 22.2.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.7 through 8.1.0.0; 8.1.1.0, 8.1.2.0, 8.1.2.1
Oracle Corporation Financial Services Behavior Detection Platform: from 8.1.1.0 through 8.1.2.1; 8.0.7.0.0, 8.0.8
Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
Oracle Corporation Oracle Financial Services Enterprise Case Management: from 8.1.1.0 through 8.1.2.1; 8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1
Oracle Financial Services Trade-Based Anti Money Laundering: 8.0.7, 8.0.8
Oracle Corporation Global Lifecycle Management NextGen OUI Framework: before 13.9.4.2.2; 13.9.4.2.2 — fixed in 13.9.4.2.2
Oracle Global Lifecycle Management Opatch: before 12.2.0.1.30 — fixed in 12.2.0.1.30
Oracle Graph Server And Client: before 22.2.0 — fixed in 22.2.0
Oracle Health Sciences Empirica Signal: 9.1.0.5.2
Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59
Oracle Corporation Primavera Gateway: from 17.12.0 through 17.12.11; from 18.8.0 through 18.8.14; from 19.12.0 through 19.12.13; from 20.12.0 through 20.12.18; from 21.12.0 through 21.12.1
Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 17.12.0.0 through 17.12.20.4; from 18.8.0.0 through 18.8.25.4; from 19.12.0 through 19.12.19.0; from 20.12.0.0 through 21.12.4.0

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.12.6.1, 2.13.2.1; Oracle Big Data Spatial And Graph 23.1; Oracle Corporation Global Lifecycle Management NextGen OUI Framework 13.9.4.2.2; Oracle Global Lifecycle Management Opatch 12.2.0.1.30; Oracle Graph Server And Client 22.2.0; Oracle Spatial Studio 20.1.0; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.13.2.1, 2.12.6.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36518 or the next vulnerability affects your stack