--- id: CVE-2020-24750 title: >- FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. summary: >- FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. severity: high cvss: 8.1 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-502 vendor: fasterxml product: jackson-databind affected: - 'jackson-databind >= 2.0.0, < 2.6.7.5' - 'jackson-databind >= 2.7.0, < 2.9.10.6' - agile_product_lifecycle_management = 9.3.6 - application_testing_suite = 13.3.0.1 - autovue_for_agile_product_lifecycle_management = 21.0.2 - banking_corporate_lending_process_management = 14.2.0 - banking_corporate_lending_process_management = 14.3.0 - banking_corporate_lending_process_management = 14.5.0 - banking_credit_facilities_process_management = 14.2.0 - banking_credit_facilities_process_management = 14.3.0 - banking_credit_facilities_process_management = 14.5.0 - banking_liquidity_management = 14.2 - banking_liquidity_management = 14.3 - banking_liquidity_management = 14.5 - banking_supply_chain_finance = 14.2.0 - banking_supply_chain_finance = 14.3.0 - banking_supply_chain_finance = 14.5.0 - blockchain_platform < 21.1.2 - communications_calendar_server = 8.0 - communications_calendar_server = 8.0.0.4.0 - communications_contacts_server = 8.0 - communications_contacts_server = 8.0.0.5.0 - 'communications_diameter_signaling_router >= 8.0.0, <= 8.2.2' - 'communications_element_manager >= 8.2.0, <= 8.2.4.0' - communications_instant_messaging_server = 10.0.1.5.0 - communications_messaging_server = 8.1 - communications_offline_mediation_controller = 12.0.0.3.0 - communications_policy_management = 12.5.0 - communications_pricing_design_center = 12.0.0.4.0 - communications_services_gatekeeper = 7.0 - 'communications_session_report_manager >= 8.0.0.0, <= 8.2.2.1' - 'communications_session_route_manager >= 8.2.0, <= 8.2.2.1' - communications_unified_inventory_management = 7.4.1 - identity_manager_connector = 11.1.1.5.0 - siebel_core_-_server_framework <= 21.5 - siebel_ui_framework <= 21.2 - debian_linux = 9.0 patched: - jackson-databind 2.9.10.6 - blockchain_platform 21.1.2 published: '2020-09-17' updated: '2026-08-25' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-24750' references: - url: >- https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b label: cve@mitre.org - url: 'https://github.com/FasterXML/jackson-databind/issues/2798' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20201009-0003/' label: cve@mitre.org - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: cve@mitre.org - url: >- https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/FasterXML/jackson-databind/issues/2798' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20201009-0003/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - exploit-available epss: 0.07327 epssPercentile: 0.94169 ingestedAt: '2026-08-25T17:29:30.308Z' exploits: github: 1 githubRepos: - 'https://github.com/Al1ex/CVE-2020-24750' checkedAt: '2026-09-26T09:05:25.898Z' exploitAvailable: true --- ## Overview FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. ## Affected - `jackson-databind >= 2.0.0, < 2.6.7.5` - `jackson-databind >= 2.7.0, < 2.9.10.6` - `agile_product_lifecycle_management = 9.3.6` - `application_testing_suite = 13.3.0.1` - `autovue_for_agile_product_lifecycle_management = 21.0.2` - `banking_corporate_lending_process_management = 14.2.0` - `banking_corporate_lending_process_management = 14.3.0` - `banking_corporate_lending_process_management = 14.5.0` - `banking_credit_facilities_process_management = 14.2.0` - `banking_credit_facilities_process_management = 14.3.0` - `banking_credit_facilities_process_management = 14.5.0` - `banking_liquidity_management = 14.2` - `banking_liquidity_management = 14.3` - `banking_liquidity_management = 14.5` - `banking_supply_chain_finance = 14.2.0` - `banking_supply_chain_finance = 14.3.0` - `banking_supply_chain_finance = 14.5.0` - `blockchain_platform < 21.1.2` - `communications_calendar_server = 8.0` - `communications_calendar_server = 8.0.0.4.0` - `communications_contacts_server = 8.0` - `communications_contacts_server = 8.0.0.5.0` - `communications_diameter_signaling_router >= 8.0.0, <= 8.2.2` - `communications_element_manager >= 8.2.0, <= 8.2.4.0` - `communications_instant_messaging_server = 10.0.1.5.0` - `communications_messaging_server = 8.1` - `communications_offline_mediation_controller = 12.0.0.3.0` - `communications_policy_management = 12.5.0` - `communications_pricing_design_center = 12.0.0.4.0` - `communications_services_gatekeeper = 7.0` - `communications_session_report_manager >= 8.0.0.0, <= 8.2.2.1` - `communications_session_route_manager >= 8.2.0, <= 8.2.2.1` - `communications_unified_inventory_management = 7.4.1` - `identity_manager_connector = 11.1.1.5.0` - `siebel_core_-_server_framework <= 21.5` - `siebel_ui_framework <= 21.2` - `debian_linux = 9.0` ## Remediation Upgrade past the affected range: - `jackson-databind 2.9.10.6` - `blockchain_platform 21.1.2`