CVE-2020-36186: Unsafe Deserialization in jackson-databind
Summary
CVE-2020-36186: Unsafe Deserialization in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind versions >= 2.0.0, < 2.9.10.8. Fixed in 2.9.10.8. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-36186 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a part of the FasterXML Jackson library for Java, which provides functionality for converting Java objects to JSON and vice versa. It is widely used in various applications and frameworks for data serialization and deserialization. However, versions of jackson-databind prior to 2.9.10.8 are vulnerable to an unsafe deserialization issue.
Vulnerability Detail
The vulnerability, identified as CVE-2020-36186, is related to the mishandling of serialization gadgets and typing in jackson-databind. Specifically, it affects the interaction between serialization gadgets and the org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource class. This vulnerability can be exploited by an attacker to execute arbitrary code or perform other malicious activities on a system that uses the vulnerable version of jackson-databind. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.10.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the jackson-databind package to the fixed version to mitigate the risk.
Conclusion
In conclusion, the CVE-2020-36186 vulnerability in jackson-databind poses a significant risk to systems using the affected versions. It is crucial to update the jackson-databind package to version 2.9.10.8 or later to mitigate the vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson-databind is a Java library that provides functionality for converting Java objects to JSON and vice versa. It is widely used for data serialization and deserialization in various applications and frameworks.
This vulnerability allows an attacker to execute arbitrary code or perform other malicious activities on a system that uses the vulnerable version of jackson-databind. It can lead to unauthorized access, data breaches, and potential system compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your pom.xml file, and Vulert will analyze it in real-time and provide alerts for any open-source vulnerabilities, including this one.
Yes, the fix for this vulnerability is to upgrade the jackson-databind package to version 2.9.10.8 or later. It is recommended to update your project's dependencies to use the latest secure version of jackson-databind.
You can find more information about this vulnerability, including its technical details and the affected versions, in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-v585-23hc-c647/GHSA-v585-23hc-c647.json
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
