CVE-2020-24616

8.1 highEPSS 7.6%

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

CVSS 3.1: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 7.6% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-25)
CWE: CWE-502
Published: 2020-08-25
Modified: 2026-10-08
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fasterxml:jackson-databind
netapp:active_iq_unified_manager
oracle:agile_product_lifecycle_management
oracle:application_testing_suite
oracle:autovue_for_agile_product_lifecycle_management
oracle:banking_liquidity_management
oracle:banking_supply_chain_finance
oracle:blockchain_platform
oracle:communications_calendar_server
oracle:communications_cloud_native_core_unified_data_repository
oracle:communications_contacts_server
oracle:communications_diameter_signaling_router
oracle:communications_element_manager
oracle:communications_evolved_communications_application_server
oracle:communications_instant_messaging_server
oracle:communications_messaging_server
oracle:communications_offline_mediation_controller
oracle:communications_policy_management
oracle:communications_pricing_design_center
oracle:communications_services_gatekeeper
oracle:communications_session_report_manager
oracle:communications_unified_inventory_management
oracle:identity_manager_connector
oracle:siebel_ui_framework

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-h3cw-g4mq-c5x2	Maven	com.fasterxml.jackson.core:jackson-databind	>=2.0.0 <2.9.10.6	2.9.10.6

References

Check your stack JSON