CVE-2020-14060: Jackson Databind Deserialization Vulnerability
Summary
CVE-2020-14060: Deserialization of untrusted data in Jackson Databind. Affects com.fasterxml.jackson.core:jackson-databind versions >= 2.9.0, < 2.9.10.5. Fixed in 2.9.10.5. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-14060 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jackson Databind is a popular Java library used for serializing and deserializing JSON data. It provides a convenient way to convert JSON objects to Java objects and vice versa. The library is widely used in various applications and frameworks. However, versions of Jackson Databind prior to 2.9.10.5 are vulnerable to a deserialization issue that can be exploited by an attacker to execute arbitrary code. This vulnerability arises from mishandling the interaction between serialization gadgets and typing, specifically related to the 'oadd.org.apache.xalan.lib.sql.JNDIConnectionPool' class (also known as 'apache/drill').
Vulnerability Detail
The deserialization vulnerability in Jackson Databind allows an attacker to execute arbitrary code by providing malicious input during the deserialization process. By exploiting this vulnerability, an attacker can potentially gain unauthorized access, perform remote code execution, or cause a denial-of-service (DoS) attack. The vulnerability is rated as HIGH severity with a CVSS score of 8.1. It falls under the Common Weakness Enumeration (CWE) category CWE-502.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.10.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the library is not immediately feasible, a possible workaround is to disable or restrict deserialization of untrusted data. This can be achieved by configuring the Jackson Databind library to use a custom deserialization whitelist or by implementing input validation and sanitization techniques to ensure only trusted data is deserialized.
Conclusion
The Jackson Databind deserialization vulnerability (CVE-2020-14060) poses a significant risk to applications using affected versions of the library. It is crucial to upgrade to version 2.9.10.5 or higher to mitigate the vulnerability. Alternatively, implement appropriate input validation and sanitization techniques to minimize the risk. For further support and assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson Databind is a Java library used for serializing and deserializing JSON data. It provides a convenient way to convert JSON objects to Java objects and vice versa.
The vulnerability allows an attacker to execute arbitrary code, potentially leading to unauthorized access, remote code execution, or denial-of-service attacks.
To fix this vulnerability, upgrade the Jackson Databind library to version 2.9.10.5 or higher. Alternatively, you can disable or restrict deserialization of untrusted data.
Yes, if upgrading the library is not immediately feasible, you can implement input validation and sanitization techniques to ensure only trusted data is deserialized.
You can find more information about this vulnerability in the CVE-2020-14060 advisory and the GitHub Security Advisory GHSA-j823-4qch-3rgm.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
