CVE-2021-20190: Deserialization of untrusted data in jackson-databind

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-19 · updated 2026-07-24
Weakness: CWE-502

Description

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected products

Apache Software Foundation Apache NiFi: from 1.7.0 through 1.12.1
Debian Linux: 9.0
FasterXML jackson-databind: before 2.6.7.5; from 2.7.0 before 2.9.10.7 — fixed in 2.6.7.5, 2.9.10.7
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Oncommand Api Services: all versions
OnCommand Insight: all versions
NetApp Service Level Manager: all versions
Oracle Commerce Experience Manager: 11.3.2
Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.7.0 before 2.9.10.7; before 2.6.7.5; 2.7.0, 2.7.1, 2.7.1-1, 2.7.2, 2.7.3, 2.7.4 (+123) — fixed in 2.9.10.7, 2.6.7.5

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.5, 2.9.10.7; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.7, 2.6.7.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-20190 or the next vulnerability affects your stack