--- id: CVE-2020-35490 title: >- FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. summary: >- FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. severity: high cvss: 8.1 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-502 vendor: fasterxml product: jackson-databind affected: - 'jackson-databind >= 2.0.0, < 2.9.10.8' - service_level_manager - debian_linux = 9.0 - agile_product_lifecycle_management = 9.3.6 - application_testing_suite = 13.3.0.1 - autovue_for_agile_product_lifecycle_management = 21.0.2 - banking_platform = 2.6.2 - banking_platform = 2.7.0 - banking_platform = 2.7.1 - banking_platform = 2.8.0 - banking_platform = 2.9.0 - banking_platform = 2.10.0 - banking_treasury_management = 14.4 - banking_virtual_account_management = 14.2.0 - banking_virtual_account_management = 14.3.0 - banking_virtual_account_management = 14.5.0 - blockchain_platform <= 21.1.2 - communications_cloud_native_core_policy = 1.14.0 - communications_cloud_native_core_unified_data_repository = 1.4.0 - 'communications_diameter_signaling_router >= 8.0.0, <= 8.5.0' - communications_evolved_communications_application_server = 7.1 - communications_instant_messaging_server = 10.0.1.5.0 - communications_interactive_session_recorder = 6.3 - communications_interactive_session_recorder = 6.4 - communications_offline_mediation_controller = 12.0.0.3 - communications_pricing_design_center = 12.0.0.4.0 - communications_services_gatekeeper = 7.0 - communications_unified_inventory_management = 7.4.1 - documaker = 12.6.3 - documaker = 12.6.4 - insurance_policy_administration_j2ee = 11.2.0 - retail_merchandising_system = 15.0.3 - retail_xstore_point_of_service = 16.0.6 - retail_xstore_point_of_service = 17.0.4 - retail_xstore_point_of_service = 18.0.3 - retail_xstore_point_of_service = 19.0.2 - webcenter_portal = 12.2.1.3.0 - webcenter_portal = 12.2.1.4.0 patched: - jackson-databind 2.9.10.8 published: '2020-12-17' updated: '2026-08-25' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-35490' references: - url: >- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 label: cve@mitre.org - url: 'https://github.com/FasterXML/jackson-databind/issues/2986' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20210122-0005/' label: cve@mitre.org - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: cve@mitre.org - url: >- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/FasterXML/jackson-databind/issues/2986' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20210122-0005/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.07821 epssPercentile: 0.9441 ingestedAt: '2026-08-25T17:29:30.471Z' --- ## Overview FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. ## Affected - `jackson-databind >= 2.0.0, < 2.9.10.8` - `service_level_manager` - `debian_linux = 9.0` - `agile_product_lifecycle_management = 9.3.6` - `application_testing_suite = 13.3.0.1` - `autovue_for_agile_product_lifecycle_management = 21.0.2` - `banking_platform = 2.6.2` - `banking_platform = 2.7.0` - `banking_platform = 2.7.1` - `banking_platform = 2.8.0` - `banking_platform = 2.9.0` - `banking_platform = 2.10.0` - `banking_treasury_management = 14.4` - `banking_virtual_account_management = 14.2.0` - `banking_virtual_account_management = 14.3.0` - `banking_virtual_account_management = 14.5.0` - `blockchain_platform <= 21.1.2` - `communications_cloud_native_core_policy = 1.14.0` - `communications_cloud_native_core_unified_data_repository = 1.4.0` - `communications_diameter_signaling_router >= 8.0.0, <= 8.5.0` - `communications_evolved_communications_application_server = 7.1` - `communications_instant_messaging_server = 10.0.1.5.0` - `communications_interactive_session_recorder = 6.3` - `communications_interactive_session_recorder = 6.4` - `communications_offline_mediation_controller = 12.0.0.3` - `communications_pricing_design_center = 12.0.0.4.0` - `communications_services_gatekeeper = 7.0` - `communications_unified_inventory_management = 7.4.1` - `documaker = 12.6.3` - `documaker = 12.6.4` - `insurance_policy_administration_j2ee = 11.2.0` - `retail_merchandising_system = 15.0.3` - `retail_xstore_point_of_service = 16.0.6` - `retail_xstore_point_of_service = 17.0.4` - `retail_xstore_point_of_service = 18.0.3` - `retail_xstore_point_of_service = 19.0.2` - `webcenter_portal = 12.2.1.3.0` - `webcenter_portal = 12.2.1.4.0` ## Remediation Upgrade past the affected range: - `jackson-databind 2.9.10.8`