CVE-2020-36518 jackson-databind
| Affected software | jackson-databind |
|---|---|
| Severity | 7.5 High CVSS 3.1 3 scores |
| Fixed in | 2.13.2.1, 2.12.6.1 |
| Weakness | Out-of-bounds write (CWE-787) |
| Published | 11 Mar 2022 |
| Updated | 17 Jun 2026 |
Description
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 1 indexed, none at 5+ stars
- EPSS 4.9% chance in 30 days
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Reproduction of CVE-2020-36518 in Spring Boot 2.5.10 | 2022-03-21 |
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
A public code fix exists: FasterXML/jackson-databind 0a8157c.
- Protection none
- Action unverified
- Review automated Upstream data
- Record active
| Decided by | Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all |
|---|---|
| Finding | This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious. |
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | Primary | published |
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:N/I:N/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2025 ↗ | CPU | 2025-Q2 | Oracle Fusion Middleware / Runtime Server (jackson-databind) (12.2.1.4.0) |
| Oracle Critical Patch Update October 2023 ↗ | CPU | 2023-Q4 | Oracle Enterprise Manager / Event Management (jackson-databind) (13.5.0.0) |
| Oracle Critical Patch Update July 2023 ↗ | CPU | 2023-Q3 | Oracle Fusion Middleware / Centralized Thirdparty Jars (jackson-databind) (12.2.1.4.0) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Blockchain Platform / BCS Console (jackson-databind) (Prior to 21.1.3) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Commerce / Content Acquisition System (jackson-databind) (11.3.2) Oracle GoldenGate / GoldenGate Stream Analytics (jackson-databind) (Prior to 19.1.0.0.8) |
| Oracle Critical Patch Update October 2022 ↗ | CPU | 2022-Q4 | Oracle Communications / Configuration Management Platform (jackson-databind) (12.6.0.0.0) Oracle Communications / Core (jackson-databind) (7.0.0.0.0) Oracle Communications / Platform (jackson-databind) (7.1) Oracle Communications Applications / PresenceAPI (jackson-databind) (10.0.1.6.0) Oracle Communications Applications / REST Service Manager (jackson-databind) (12.0.0.4.0-12.0.0.7.0) Oracle Database Server / Oracle Database - Fleet Patching (jackson-databind) (19c, 21c) Oracle Database Server / Spatial and Graph (jackson-databind) (19c, 21c) Oracle Enterprise Manager / Plug-In Lifecycle (jackson-databind) (13.4.0.0, 13.5.0.0) Oracle Financial Services Applications / Collections (jackson-databind) (2.12.0) Oracle Financial Services Applications / Security (jackson-databind) (2.7.1, 2.9.0, 2.12.0) Oracle Financial Services Applications / Web UI (jackson-databind) (2.7.0) Oracle Financial Services Applications / Web UI (jackson-databind) (2.8.0, 2.12.0) Oracle Fusion Middleware / Analytics Server (jackson-databind) (6.4.0.0) Oracle Fusion Middleware / Security Framework (jackson-databind) (12.2.1.3.0, 12.2.1.4.0) Oracle HealthCare Applications / Data Studio (jackson-databind) (4.1) Oracle Insurance Applications / Development Tools (jackson-databind) (12.6-12.7) Oracle JD Edwards / E1 IOT Orchestrator Security (jackson-databind) (9.2.6.4 and prior) Oracle JD Edwards / Monitoring and Diagnostics SEC (jackson-databind) (9.2.6.4 and prior) Oracle JD Edwards / Web Runtime SEC (jackson-databind) (9.2.6.4 and prior) Oracle Retail Applications / Foundation (jackson-databind) (15.0.3.1) Oracle Retail Applications / RSB Installation (jackson-databind) (14.1.3.2, 15.0.3.1, 16.0.3) Oracle Siebel CRM / EAI (jackson-databind) (22.8 and prior) Oracle Supply Chain / AutoVue Client and Server (jackson-databind) (21.0.2) Oracle's note: This vulnerability applies to Oracle AutoVue Office, Oracle AutoVue 2D Professional, Oracle AutoVue 3D Professional Advanced, Oracle AutoVue EDA Professional and Oracle AutoVue Electro-Mechanical Professional. Please refer to Patch Availability Document for more details. Oracle Supply Chain / Autovue Client (jackson-databind) (21.0.2) Oracle Supply Chain / WebClient (jackson-databind) (9.3.6) Oracle Systems / Tools (jackson-databind) (4) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Big Data Graph / Big Data Graph (jackson-databind) (Prior to 23.1) Oracle Commerce / Dynamo Application Framework (jackson-databind) (11.3.0, 11.3.1, 11.3.2) Oracle Communications / BSF (jackson-databind) (22.1.3) Oracle Communications / MGMT (jackson-databind) (9.0, 9.1) Oracle Communications / NRF (jackson-databind) (22.1.2, 22.2.0) Oracle Communications / NSSF (jackson-databind) (22.1.1) Oracle Communications / SCP (jackson-databind) (22.2.0) Oracle Communications / SEPP (jackson-databind) (22.1.1) Oracle Communications / UDR (jackson-databind) (22.2.0) Oracle Communications Applications / Billing Care, BOC, DM Kafka, REST API (jackson-databind) (12.0.0.4.0-12.0.0.6.0) Oracle Construction and Engineering / Admin (jackson-databind) (17.12.0-17.12.11, 18.8.0-18.8.14, 19.12.0-19.12.13, 20.12.0-20.12.8, 21.12.0-21.12.1) Oracle Construction and Engineering / Document Management (jackson-databind) (17.7-17.12, 18.8, 19.12, 20.12, 21.12) Oracle Construction and Engineering / Web Access (jackson-databind) (17.12.0.0-17.12.20.4, 18.8.0.0-18.8.25.4, 19.12.0.0-19.12.19.0, 20.12.0.0-20.12.14.0, 21.12.0.0-21.12.4.0) Oracle Financial Services Applications / Installers (jackson-databind) (8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1, 8.1.1.0-8.1.2.1) Oracle Financial Services Applications / Others (jackson-databind) (8.0.7.0-8.1.0.0, 8.1.1.0, 8.1.2.0, 8.1.2.1) Oracle Financial Services Applications / Studio (jackson-databind) (8.0.8.2.0, 8.0.8.3.0) Oracle Financial Services Applications / User Interface (jackson-databind) (8.0.7.0, 8.0.8.0) Oracle Financial Services Applications / Web UI (jackson-databind) (8.0.7.0, 8.0.8.0, 8.1.1.0-8.1.2.1) Oracle Fusion Middleware / Centralized Third Party Jars (jackson-databind) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) Oracle Fusion Middleware / Centralized Thirdparty Jars (jackson-databind) (14.1.1.0.0) Oracle Fusion Middleware / NextGen Installer issues (jackson-databind) (Prior to 13.9.4.2.10) Oracle Graph Server and Client / Oracle Graph Server (jackson-databind) (Prior to 22.2.0) Oracle Health Sciences Applications / Web Services (jackson-databind) (9.1.0.52, 9.2.0.52) Oracle PeopleSoft / Elastic Search (jackson-databind) (8.58, 8.59) Oracle Retail Applications / others (jackson-databind) (15.0.3.1) Oracle Spatial Studio / Oracle Spatial Studio (jackson-databind) (Prior to 22.1.0) Oracle Utilities Applications / General (jackson-databind) (4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0) |
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Communications / CNC Console (jackson-databind) (1.9.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Big Data Graph | Big Data Graph (jackson-databind) | Prior to 23.1 | |
| Oracle Blockchain Platform | BCS Console (jackson-databind) | Prior to 21.1.3 | |
| Oracle Commerce | Content Acquisition System (jackson-databind) | 11.3.2 | 11.3.2 |
| Oracle Commerce | Dynamo Application Framework (jackson-databind) | 11.3.0, 11.3.1, 11.3.2 | 11.3.0 · 11.3.1 · 11.3.2 |
| Oracle Communications | BSF (jackson-databind) | 22.1.3 | 22.1.3 |
| Oracle Communications | CNC Console (jackson-databind) | 1.9.0 | 1.9.0 |
| Oracle Communications | Configuration Management Platform (jackson-databind) | 12.6.0.0.0 | 12.6.0.0.0 |
| Oracle Communications | Core (jackson-databind) | 7.0.0.0.0 | 7.0.0.0.0 |
| Oracle Communications | MGMT (jackson-databind) | 9.0, 9.1 | 9.0 · 9.1 |
| Oracle Communications | NRF (jackson-databind) | 22.1.2, 22.2.0 | 22.1.2 · 22.2.0 |
| Oracle Communications | NSSF (jackson-databind) | 22.1.1 | 22.1.1 |
| Oracle Communications | Platform (jackson-databind) | 7.1 | 7.1 |
| Oracle Communications | SCP (jackson-databind) | 22.2.0 | 22.2.0 |
| Oracle Communications | SEPP (jackson-databind) | 22.1.1 | 22.1.1 |
| Oracle Communications | UDR (jackson-databind) | 22.2.0 | 22.2.0 |
| Oracle Communications Applications | Billing Care, BOC, DM Kafka, REST API (jackson-databind) | 12.0.0.4.0-12.0.0.6.0 | |
| Oracle Communications Applications | PresenceAPI (jackson-databind) | 10.0.1.6.0 | 10.0.1.6.0 |
| Oracle Communications Applications | REST Service Manager (jackson-databind) | 12.0.0.4.0-12.0.0.7.0 | |
| Oracle Construction and Engineering | Admin (jackson-databind) | 17.12.0-17.12.11, 18.8.0-18.8.14, 19.12.0-19.12.13, 20.12.0-20.12.8, 21.12.0-21.12.1 | |
| Oracle Construction and Engineering | Document Management (jackson-databind) | 17.7-17.12, 18.8, 19.12, 20.12, 21.12 | 18.8 · 19.12 · 20.12 · 21.12 |
| Oracle Construction and Engineering | Web Access (jackson-databind) | 17.12.0.0-17.12.20.4, 18.8.0.0-18.8.25.4, 19.12.0.0-19.12.19.0, 20.12.0.0-20.12.14.0, 21.12.0.0-21.12.4.0 | |
| Oracle Database Server | Oracle Database - Fleet Patching (jackson-databind) | 19c, 21c | 19 · 21 |
| Oracle Database Server | Spatial and Graph (jackson-databind) | 19c, 21c | 19 · 21 |
| Oracle Enterprise Manager | Event Management (jackson-databind) | 13.5.0.0 | 13.5.0.0 |
| Oracle Enterprise Manager | Plug-In Lifecycle (jackson-databind) | 13.4.0.0, 13.5.0.0 | 13.4.0.0 · 13.5.0.0 |
| Oracle Financial Services Applications | Collections (jackson-databind) | 2.12.0 | 2.12.0 |
| Oracle Financial Services Applications | Installers (jackson-databind) | 8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1, 8.1.1.0-8.1.2.1 | 8.0.7.1 · 8.0.7.2 · 8.0.8.0 · 8.0.8.1 |
| Oracle Financial Services Applications | Others (jackson-databind) | 8.0.7.0-8.1.0.0, 8.1.1.0, 8.1.2.0, 8.1.2.1 | 8.1.1.0 · 8.1.2.0 · 8.1.2.1 |
| Oracle Financial Services Applications | Security (jackson-databind) | 2.7.1, 2.9.0, 2.12.0 | 2.7.1 · 2.9.0 · 2.12.0 |
| Oracle Financial Services Applications | Studio (jackson-databind) | 8.0.8.2.0, 8.0.8.3.0 | 8.0.8.2.0 · 8.0.8.3.0 |
| Oracle Financial Services Applications | User Interface (jackson-databind) | 8.0.7.0, 8.0.8.0 | 8.0.7.0 · 8.0.8.0 |
| Oracle Financial Services Applications | Web UI (jackson-databind) | 8.0.7.0, 8.0.8.0, 8.1.1.0-8.1.2.1 | 2.7.0 · 2.8.0 · 2.12.0 · 8.0.7.0 · 8.0.8.0 |
| Oracle Fusion Middleware | Analytics Server (jackson-databind) | 6.4.0.0 | 6.4.0.0 |
| Oracle Fusion Middleware | Centralized Third Party Jars (jackson-databind) | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Centralized Thirdparty Jars (jackson-databind) | 12.2.1.4.0 | 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | NextGen Installer issues (jackson-databind) | Prior to 13.9.4.2.10 | |
| Oracle Fusion Middleware | Runtime Server (jackson-databind) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Security Framework (jackson-databind) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle GoldenGate | GoldenGate Stream Analytics (jackson-databind) | Prior to 19.1.0.0.8 | |
| Oracle Graph Server and Client | Oracle Graph Server (jackson-databind) | Prior to 22.2.0 | |
| Oracle Health Sciences Applications | Web Services (jackson-databind) | 9.1.0.52, 9.2.0.52 | 9.1.0.52 · 9.2.0.52 |
| Oracle HealthCare Applications | Data Studio (jackson-databind) | 4.1 | 4.1 |
| Oracle Insurance Applications | Development Tools (jackson-databind) | 12.6-12.7 | |
| Oracle JD Edwards | E1 IOT Orchestrator Security (jackson-databind) | 9.2.6.4 and prior | |
| Oracle JD Edwards | Monitoring and Diagnostics SEC (jackson-databind) | 9.2.6.4 and prior | |
| Oracle JD Edwards | Web Runtime SEC (jackson-databind) | 9.2.6.4 and prior | |
| Oracle PeopleSoft | Elastic Search (jackson-databind) | 8.58, 8.59 | 8.58 · 8.59 |
| Oracle Retail Applications | Foundation (jackson-databind) | 15.0.3.1 | 15.0.3.1 |
| Oracle Retail Applications | RSB Installation (jackson-databind) | 14.1.3.2, 15.0.3.1, 16.0.3 | 14.1.3.2 · 15.0.3.1 · 16.0.3 |
| Oracle Retail Applications | others (jackson-databind) | 15.0.3.1 | 15.0.3.1 |
| Oracle Siebel CRM | EAI (jackson-databind) | 22.8 and prior | |
| Oracle Spatial Studio | Oracle Spatial Studio (jackson-databind) | Prior to 22.1.0 | |
| Oracle Supply Chain | AutoVue Client and Server (jackson-databind) | 21.0.2 | 21.0.2 |
| Oracle Supply Chain | Autovue Client (jackson-databind) | 21.0.2 | 21.0.2 |
| Oracle Supply Chain | WebClient (jackson-databind) | 9.3.6 | 9.3.6 |
| Oracle Systems | Tools (jackson-databind) | 4 | 4 |
| Oracle Utilities Applications | General (jackson-databind) | 4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0 | 4.3.0.5.0 · 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 · 4.5.0.0.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
com.fasterxml.jackson.core:jackson-databind |
2.13.0 | 2.13.2.1 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
0 | 2.12.6.1 |
unbounded |
Products and versions
37 products, 77 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | com.fasterxml.jackson.core | jackson-databind | generic | ＜ 2.12.6.1 · ≥ 2.13.0 and ＜ 2.13.2.1 |
| nvd | debian | debian linux | generic | 9.0 · 10.0 · 11.0 |
| nvd | fasterxml | jackson-databind | generic | ＜ 2.12.6.1 · ≥ 2.13.0 and ＜ 2.13.2.1 |
| nvd | netapp | active iq unified manager | generic | any version |
| nvd | netapp | cloud insights acquisition unit | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | netapp | snap creator framework | generic | any version |
| nvd | oracle | big data spatial and graph | generic | ＜ 23.1 |
| nvd | oracle | coherence | generic | 14.1.1.0.0 |
| nvd | oracle | commerce platform | generic | 11.3.0 · 11.3.1 · 11.3.2 |
| nvd | oracle | communications billing and revenue management | generic | ≥ 12.0.0.4.0 and ≤ 12.0.0.6.0 |
| nvd | oracle | communications cloud native core binding support function | generic | 22.1.3 |
| nvd | oracle | communications cloud native core console | generic | 1.9.0 |
| nvd | oracle | communications cloud native core network repository function | generic | 22.1.2 · 22.2.0 |
| nvd | oracle | communications cloud native core network slice selection function | generic | 22.1.0 · 22.1.1 |
| nvd | oracle | communications cloud native core security edge protection proxy | generic | 22.1.1 |
| nvd | oracle | communications cloud native core service communication proxy | generic | 22.2.0 |
| nvd | oracle | communications cloud native core unified data repository | generic | 22.2.0 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 8.0.7 and ≤ 8.1.0.0 · 8.1.1.0 · 8.1.2.0 · 8.1.2.1 |
| nvd | oracle | financial services behavior detection platform | generic | 8.0.7.0.0 · 8.0.8 · ≥ 8.1.1.0 and ≤ 8.1.2.1 |
| nvd | oracle | financial services crime and compliance management studio | generic | 8.0.8.2.0 · 8.0.8.3.0 |
| nvd | oracle | financial services enterprise case management | generic | 8.0.7.1 · 8.0.7.2 · 8.0.8.0 · 8.0.8.1 · ≥ 8.1.1.0 and ≤ 8.1.2.1 |
| nvd | oracle | financial services trade-based anti money laundering | generic | 8.0.7 · 8.0.8 |
| nvd | oracle | global lifecycle management nextgen oui framework | generic | 13.9.4.2.2 · ＜ 13.9.4.2.2 |
| nvd | oracle | global lifecycle management opatch | generic | ＜ 12.2.0.1.30 |
| nvd | oracle | graph server and client | generic | ＜ 22.2.0 |
| nvd | oracle | health sciences empirica signal | generic | 9.1.0.5.2 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.58 · 8.59 |
| nvd | oracle | primavera gateway | generic | ≥ 17.12.0 and ≤ 17.12.11 · ≥ 18.8.0 and ≤ 18.8.14 · ≥ 19.12.0 and ≤ 19.12.13 · ≥ 20.12.0 and ≤ 20.12.18 · ≥ 21.12.0 and ≤ 21.12.1 |
| nvd | oracle | primavera p6 enterprise project portfolio management | generic | ≥ 17.12.0.0 and ≤ 17.12.20.4 · ≥ 18.8.0.0 and ≤ 18.8.25.4 · ≥ 19.12.0 and ≤ 19.12.19.0 · ≥ 20.12.0.0 and ≤ 21.12.4.0 |
| nvd | oracle | primavera unifier | generic | ≥ 17.0 and ≤ 17.12 · 18.0 · 19.12 · 20.12 · 21.12 |
| nvd | oracle | retail sales audit | generic | 15.0.3.1 |
| nvd | oracle | sd-wan edge | generic | 9.0 · 9.1 |
| nvd | oracle | spatial studio | generic | ＜ 20.1.0 |
| nvd | oracle | utilities framework | generic | 4.3.0.5.0 · 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 · 4.4.0.5.0 |
| nvd | oracle | weblogic server | generic | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
References
Timeline
Timeline
| Published | 2022-03-11 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |