CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2020-36518
High (7.5). EPSS 4.9% chance of exploitation in the next 30 days. Fixed in com.fasterxml.jackson.core:jackson-databind 2.12.6.1, 2.13.2.1.
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Severity
- EPSS
- 4.9% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-11-01)
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fasterxml:jackson-databind
- netapp:active_iq_unified_manager
- netapp:cloud_insights_acquisition_unit
- netapp:oncommand_insight
- netapp:oncommand_workflow_automation
- netapp:snap_creator_framework
- oracle:big_data_spatial_and_graph
- oracle:coherence
- oracle:commerce_platform
- oracle:communications_billing_and_revenue_management
- oracle:communications_cloud_native_core_binding_support_function
- oracle:communications_cloud_native_core_console
- oracle:communications_cloud_native_core_network_repository_function
- oracle:communications_cloud_native_core_network_slice_selection_function
- oracle:communications_cloud_native_core_security_edge_protection_proxy
- oracle:communications_cloud_native_core_service_communication_proxy
- oracle:communications_cloud_native_core_unified_data_repository
- oracle:financial_services_analytical_applications_infrastructure
- oracle:financial_services_behavior_detection_platform
- oracle:financial_services_crime_and_compliance_management_studio
- oracle:financial_services_enterprise_case_management
- oracle:financial_services_trade-based_anti_money_laundering
- oracle:global_lifecycle_management_nextgen_oui_framework
- oracle:global_lifecycle_management_opatch
- oracle:graph_server_and_client
- oracle:health_sciences_empirica_signal
- oracle:peoplesoft_enterprise_peopletools
- oracle:primavera_gateway
- oracle:primavera_p6_enterprise_project_portfolio_management
- oracle:primavera_unifier
- oracle:retail_sales_audit
- oracle:sd-wan_edge
- oracle:spatial_studio
- oracle:utilities_framework
- oracle:weblogic_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-57j2-w4cx-62h2 | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.13.0 <2.13.2.1 | 2.13.2.1 |
| GHSA-57j2-w4cx-62h2 | Maven | com.fasterxml.jackson.core:jackson-databind | <2.12.6.1 | 2.12.6.1 |