CVE-2020-9546: jackson-databind mishandles the interaction between serialization gadgets and typing

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-02 · updated 2026-10-07
Weakness: CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Affected products

Debian Linux: 8.0
FasterXML jackson-databind: from 2.0.0 before 2.7.9.7; from 2.8.0 before 2.8.11.6; from 2.9.0 before 2.9.10.4 — fixed in 2.7.9.7, 2.8.11.6, 2.9.10.4
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
Oracle Corporation Oracle Agile PLM: 9.3.6
Oracle Autovue For Agile Product Lifecycle Management: 21.0.2
Oracle Corporation Banking Digital Experience: 18.1, 18.2, 18.3, 19.1, 19.2, 20.1
Oracle Banking Platform: from 2.4.0 through 2.9.0
Oracle Communications Calendar Server: 8.0.0.4.0
Oracle Communications Contacts Server: 8.0.0.4.0, 8.0.0.5.0
Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.2.2
Oracle Communications Element Manager: from 8.2.0 through 8.2.2
Oracle Communications Evolved Communications Application Server: 7.1
Oracle Communications Instant Messaging Server: 10.0.1.4.0
Oracle Communications Network Charging And Control: from 12.0.0 through 12.0.3; 6.0.1
Oracle Communications Session Report Manager: from 8.2.0 through 8.2.2
Oracle Communications Session Route Manager: from 8.2.0 through 8.2.2
Oracle Corporation Enterprise Manager Base Platform: 13.3.0.0, 13.4.0.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.1.0
Oracle Financial Services Institutional Performance Analytics: 8.0.6, 8.0.7, 8.1.0, 8.7.0
Oracle Corporation Financial Services Price Creation and Discovery: 8.0.6, 8.0.7
Oracle Financial Services Retail Customer Analytics: 8.0.6
Oracle Global Lifecycle Management Opatch: before 12.2.0.1.20 — fixed in 12.2.0.1.20
Oracle Insurance Policy Administration J2Ee: 11.0.2.25, 11.1.0.15
Oracle Corporation JD Edwards EnterpriseOne Orchestrator: before 9.2.4.2 — fixed in 9.2.4.2
Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.4.2 — fixed in 9.2.4.2
Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12
Oracle Corporation Retail Merchandising System: 15.0
Oracle Retail Sales Audit: 14.1
Oracle Retail Service Backbone: 14.1, 15.0, 16.0
Oracle Corporation Retail Xstore Point of Service: 15.0, 16.0, 17.0, 18.0, 19.0

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.7.9.7, 2.8.11.6, 2.9.10.4; Oracle Global Lifecycle Management Opatch 12.2.0.1.20; Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.4.2; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.4.2; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-9546 or the next vulnerability affects your stack