CVE-2020-11620: jackson-databind mishandles the interaction between serialization gadgets and typing
Summary
CVE-2020-11620: jackson-databind mishandles the interaction between serialization gadgets and typing. Affects com.fasterxml.jackson.core:jackson-databind versions >= 2.9.0, < 2.9.10.4. Fixed in 2.9.10.4. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-11620 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a part of the FasterXML Jackson library, which provides a set of data-binding APIs for converting Java objects to and from JSON. It is widely used in Java applications for JSON processing and serialization. This vulnerability affects versions of jackson-databind prior to 2.9.10.4.
Vulnerability Detail
The vulnerability in jackson-databind arises from the mishandling of the interaction between serialization gadgets and typing. Specifically, it affects the org.apache.commons.jelly.impl.Embedded class (also known as commons-jelly). This flaw can be exploited by an attacker to execute arbitrary code remotely, leading to potential remote code execution (RCE) and other security risks.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.10.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version of jackson-databind.
Conclusion
The vulnerability in jackson-databind can have severe consequences, including remote code execution. It is crucial to upgrade to the patched version (2.9.10.4 or later) to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
jackson-databind is a Java library that provides data-binding APIs for converting Java objects to and from JSON.
The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to remote code execution (RCE) and other security risks.
Versions of jackson-databind prior to 2.9.10.4 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is essential to upgrade to the patched version of jackson-databind.
To fix this vulnerability, you should upgrade the jackson-databind package to version 2.9.10.4 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
