CVE-2020-36189: Unsafe Deserialization in jackson-databind
Summary
CVE-2020-36189: Unsafe Deserialization in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 2 version ranges.
< 2.6.7.5
>= 2.7.0, < 2.9.10.8
Fixed in 2.6.7.5 or 2.9.10.8, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-36189 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library for serializing and deserializing JSON data. It provides functionality for converting JSON objects to Java objects and vice versa. This vulnerability, identified as CVE-2020-36189, affects versions of jackson-databind prior to 2.9.10.8. It involves mishandling the interaction between serialization gadgets and typing, specifically related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Vulnerability Detail
The vulnerability arises from a flaw in the way jackson-databind handles deserialization. Attackers can exploit this flaw by crafting malicious JSON payloads that, when deserialized by a vulnerable application using the affected version of jackson-databind, can lead to remote code execution or other security breaches. This can have severe consequences, including unauthorized access to sensitive data, system compromise, or the execution of arbitrary code.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.7.52.6.7.5 -
>= 2.7.0, < 2.9.10.82.9.10.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if upgrading to the fixed version is not immediately feasible, developers can consider implementing input validation and sanitization measures to mitigate the risk of deserialization attacks. This involves carefully validating and filtering user-supplied JSON inputs before passing them to the deserialization process. By enforcing strict validation rules and rejecting any suspicious or unexpected input, the impact of the vulnerability can be reduced.
Conclusion
The CVE-2020-36189 vulnerability in jackson-databind exposes applications to the risk of remote code execution and unauthorized access to sensitive data. It is crucial to promptly upgrade to the fixed version of jackson-databind (2.9.10.8 or later) to mitigate this vulnerability. Additionally, implementing input validation and regularly monitoring for security updates are recommended practices to ensure the ongoing security of the application. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
jackson-databind is a Java library used for converting JSON objects to Java objects and vice versa. It is widely used in many applications and frameworks for handling JSON data.
This vulnerability can allow attackers to execute arbitrary code or gain unauthorized access to sensitive data. It poses a significant risk to the security and integrity of affected applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, upgrading jackson-databind to version 2.9.10.8 or later will fix this vulnerability. It is recommended to update your project's dependencies to use the latest fixed version.
Implementing input validation and sanitization measures can help mitigate the risk of deserialization attacks. By carefully validating and filtering user-supplied JSON inputs, the impact of the vulnerability can be reduced.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
