CVE-2020-14061

8.1 highEPSS 4.5%

High (8.1). EPSS 4.5% chance of exploitation in the next 30 days. Fixed in com.fasterxml.jackson.core:jackson-databind 2.9.10.5.

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.5% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2020-06-14
Modified: 2026-08-25
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fasterxml:jackson-databind
netapp:active_iq_unified_manager
netapp:steelstore_cloud_integrated_storage
oracle:agile_product_lifecycle_management
oracle:autovue_for_agile_product_lifecycle_management
oracle:banking_digital_experience
oracle:communications_calendar_server
oracle:communications_contacts_server
oracle:communications_diameter_signaling_router
oracle:communications_element_manager
oracle:communications_evolved_communications_application_server
oracle:communications_instant_messaging_server
oracle:communications_session_report_manager
oracle:communications_session_route_manager

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-c2q3-4qrh-fm48	Maven	com.fasterxml.jackson.core:jackson-databind	>=2.9.0 <2.9.10.5	2.9.10.5

References

Check your stack JSON