CVE-2020-10650: Unsafe Deserialization Vulnerability in com.fasterxml.jackson.core:jackson-databind
Summary
CVE-2020-10650: jackson-databind vulnerable to unsafe deserialization. Affects com.fasterxml.jackson.core:jackson-databind versions < 2.9.10.4. Fixed in 2.9.10.4. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-10650 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.fasterxml.jackson.core:jackson-databind library is a popular Java library used for data binding between Java objects and JSON. It provides functionality for reading and writing JSON data. This vulnerability affects versions of the library prior to 2.9.10.4.
Vulnerability Detail
The vulnerability in com.fasterxml.jackson.core:jackson-databind arises from unsafe deserialization when handling interactions related to the class ignite-jta. An attacker can exploit this vulnerability to execute arbitrary code or perform other malicious activities. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.10.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the library to the fixed version.
Conclusion
The com.fasterxml.jackson.core:jackson-databind library prior to version 2.9.10.4 is vulnerable to an unsafe deserialization vulnerability. It is crucial to update the library to the fixed version to mitigate the risk of arbitrary code execution or other malicious activities. For additional support, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
com.fasterxml.jackson.core:jackson-databind is a Java library used for data binding between Java objects and JSON. It provides functionality for reading and writing JSON data.
Unsafe deserialization refers to the process of deserializing untrusted data without proper validation or sanitization. This can lead to the execution of arbitrary code or other malicious activities.
This vulnerability allows an attacker to execute arbitrary code or perform other malicious activities. It can lead to remote code execution, data leakage, or unauthorized access.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
