CVE-2020-9546

9.8 criticalEPSS 4.6%

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

CVSS 3.1: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 4.6% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-25)
CWE: CWE-502
Published: 2020-03-02
Modified: 2026-10-07
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fasterxml:jackson-databind
netapp:active_iq_unified_manager
oracle:agile_product_lifecycle_management
oracle:autovue_for_agile_product_lifecycle_management
oracle:banking_digital_experience
oracle:banking_platform
oracle:communications_calendar_server
oracle:communications_contacts_server
oracle:communications_diameter_signaling_router
oracle:communications_element_manager
oracle:communications_evolved_communications_application_server
oracle:communications_instant_messaging_server
oracle:communications_network_charging_and_control
oracle:communications_session_report_manager
oracle:communications_session_route_manager
oracle:enterprise_manager_base_platform
oracle:financial_services_analytical_applications_infrastructure
oracle:financial_services_institutional_performance_analytics
oracle:financial_services_price_creation_and_discovery
oracle:financial_services_retail_customer_analytics
oracle:global_lifecycle_management_opatch
oracle:insurance_policy_administration_j2ee
oracle:jd_edwards_enterpriseone_orchestrator
oracle:jd_edwards_enterpriseone_tools
oracle:primavera_unifier
oracle:retail_merchandising_system
oracle:retail_sales_audit
oracle:retail_service_backbone
oracle:retail_xstore_point_of_service
oracle:weblogic_server

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-5p34-5m6p-p58g	Maven	com.fasterxml.jackson.core:jackson-databind	>=2.9.0 <2.9.10.4	2.9.10.4

References

Check your stack JSON