CVE-2020-36518

HIGH

Fasterxml Jackson-databind < 2.12.6.1 - Out-of-Bounds Write

Title source: rule

Description

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

Exploits (3)

nomisec STUB

by dawetmaster · poc

https://github.com/dawetmaster/CVE-2020-36518-jackson-databind-vulnerable

View Code ZIP pw:eip

nomisec STUB

by andikahilmy · poc

https://github.com/andikahilmy/CVE-2020-36518-jackson-databind-vulnerable

View Code ZIP pw:eip

nomisec STUB

by ghillert · poc

https://github.com/ghillert/boot-jackson-cve

View Code ZIP pw:eip

References (7)

[Issue Tracking, Third Party Advisory] https://github.com/FasterXML/jackson-databind/issues/2816

[Exploit, Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html

[Third Party Advisory] https://security.netapp.com/advisory/ntap-20220506-0004/

[Third Party Advisory] https://www.debian.org/security/2022/dsa-5283

[Third Party Advisory] https://www.oracle.com/security-alerts/cpuapr2022.html

[Third Party Advisory] https://www.oracle.com/security-alerts/cpujul2022.html

Scores

CVSS v3 7.5

EPSS 0.0051

EPSS Percentile 66.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-787

Status published

Products (48)

com.fasterxml.jackson.core/jackson-databind 2.13.0 - 2.13.2.1Maven

debian/debian_linux 9.0

debian/debian_linux 10.0

debian/debian_linux 11.0

fasterxml/jackson-databind < 2.12.6.1

netapp/active_iq_unified_manager (3 CPE variants)

netapp/cloud_insights_acquisition_unit

netapp/oncommand_insight

netapp/oncommand_workflow_automation

netapp/snap_creator_framework

... and 38 more

Published Mar 11, 2022

Tracked Since Feb 18, 2026