CVE-2020-25649: XML External Entity (XXE) Injection in Jackson Databind
Summary
CVE-2020-25649: XML External Entity (XXE) Injection in Jackson Databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.6.0, < 2.6.7.4
>= 2.7.0.0, < 2.9.10.7
>= 2.10.0.0, < 2.10.5.1
Fixed in 2.6.7.4, 2.9.10.7 or 2.10.5.1, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-25649 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jackson Databind is a popular Java library used for converting JSON to Java objects (POJOs) and vice versa. It provides functionality for parsing, generating, and manipulating JSON data. However, a vulnerability has been discovered in Jackson Databind that allows for XML External Entity (XXE) injection attacks. This vulnerability arises from improper entity expansion, which can lead to data integrity issues.
Vulnerability Detail
The XML External Entity (XXE) vulnerability in Jackson Databind allows an attacker to exploit the entity expansion feature of XML parsers. By injecting specially crafted XML input, an attacker can read arbitrary files on the server or perform other malicious actions. This vulnerability can have severe consequences, including unauthorized access to sensitive data, server-side request forgery (SSRF), and denial of service (DoS) attacks.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 2.6.7.42.6.7.4 -
>= 2.7.0.0, < 2.9.10.72.9.10.7 -
>= 2.10.0.0, < 2.10.5.12.10.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround is to disable entity expansion in the XML parser used by Jackson Databind. This can be achieved by configuring the parser to disallow external entities. Here is an example of how to disable entity expansion in the Woodstox XML parser, which is commonly used by Jackson Databind:
XMLInputFactory xmlInputFactory = new WstxInputFactory();
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
xmlInputFactory.setProperty(WstxInputProperties.P_MAX_ENTITY_COUNT, 0);
Please note that this workaround may have limitations and it is strongly recommended to upgrade to a fixed version as soon as possible.
Conclusion
The XML External Entity (XXE) vulnerability in Jackson Databind poses a significant risk to the integrity of data. It is crucial to upgrade to a fixed version of Jackson Databind or apply the recommended workaround to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
XML External Entity (XXE) injection is a type of attack where an attacker can exploit the entity expansion feature of XML parsers to read arbitrary files or perform other malicious actions.
This vulnerability can lead to unauthorized access to sensitive data, server-side request forgery (SSRF), denial of service (DoS) attacks, and other security breaches.
Versions 2.6.0 to 2.6.7.3, 2.7.0.0 to 2.9.10.6, and 2.10.0.0 to 2.10.5.0 of Jackson Databind are affected by this vulnerability.
To mitigate this vulnerability, it is recommended to upgrade to a fixed version of Jackson Databind as soon as possible. If upgrading is not immediately feasible, you can apply the workaround of disabling entity expansion in the XML parser used by Jackson Databind.
You can find more information about this vulnerability, including the affected versions and fixed versions, in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/02/GHSA-288c-cq4h-88gq/GHSA-288c-cq4h-88gq.json
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
