CVE-2020-11111

8.8 highEPSS 3.6%

High (8.8). EPSS 3.6% chance of exploitation in the next 30 days. Fixed in com.fasterxml.jackson.core:jackson-databind 2.9.10.4.

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 3.6% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2020-03-31
Modified: 2026-08-25
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fasterxml:jackson-databind
netapp:steelstore_cloud_integrated_storage
oracle:agile_product_lifecycle_management
oracle:autovue_for_agile_product_lifecycle_management
oracle:banking_digital_experience
oracle:banking_platform
oracle:communications_calendar_server
oracle:communications_contacts_server
oracle:communications_diameter_signaling_router
oracle:communications_element_manager
oracle:communications_evolved_communications_application_server
oracle:communications_instant_messaging_server
oracle:communications_network_charging_and_control
oracle:communications_session_report_manager
oracle:communications_session_route_manager
oracle:enterprise_manager_base_platform
oracle:global_lifecycle_management_opatch
oracle:jd_edwards_enterpriseone_orchestrator
oracle:jd_edwards_enterpriseone_tools
oracle:primavera_unifier
oracle:retail_merchandising_system
oracle:retail_sales_audit
oracle:retail_xstore_point_of_service
oracle:weblogic_server

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-v3xw-c963-f5hc	Maven	com.fasterxml.jackson.core:jackson-databind	>=2.9.0 <2.9.10.4	2.9.10.4

References

Check your stack JSON