Skip to content
Fencer Vulns
high 7.5

CVE-2020-36518 json

Deeply nested json in jackson-databind

published 2022-03-11 4 y ago modified 2026-09-10 1 mo ago also GHSA-57j2-w4cx-62h2 , EUVD-2022-1319

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.9%
EPSS 4.9% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

Patch / fix

  • maven com.fasterxml.jackson.core:jackson-databind 2.12.6.1, 2.13.2.1
  • fasterxml jackson-databind 2.12.6.1, 2.13.2.1
  • oracle big_data_spatial_and_graph 23.1
  • oracle global_lifecycle_management_nextgen_oui_framework 13.9.4.2.2
  • oracle global_lifecycle_management_opatch 12.2.0.1.30
  • oracle graph_server_and_client 22.2.0
  • oracle spatial_studio 20.1.0
  • jackson-databind Debian 14, Debian 13, Debian 12 2.13.2.2-1

debian advisories DEBIAN-CVE-2020-36518

  • eap7-netty jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.5-3.GA_redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.17-2.SP4_redhat_00001.1.el7eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-xerces-j2 jboss enterprise application platform 7.4 2.12.0-3.SP04_redhat_00001.1.el7eap
  • eap7-h2database jboss enterprise application platform 7.4 1.4.197-2.redhat_00004.1.el7eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.12-1.Final_redhat_00001.1.el7eap
  • eap7-netty-codec jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap

red hat advisories RHSA-2025:9583RHSA-2025:9582RHSA-2022:4918RHSA-2022:4919RHSA-2022:7411RHSA-2022:7409

  • jackson-core SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +12 more 2.13.0-150200.3.6.1
  • jackson-bom openSUSE Leap 15.4, openSUSE Leap 15.3 2.13.0-150200.3.3.1
  • jackson-databind SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +12 more 2.13.0-150200.3.9.1
  • jackson-annotations SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +12 more 2.13.0-150200.3.6.1
  • jackson-dataformats-binary SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +11 more 2.13.0-150200.3.3.3

suse advisories SUSE-SU-2022:1678-1

  • xsom AlmaLinux 8 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
  • slf4j AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • stax-ex AlmaLinux 8 1.7.7-8.module_el8.5.0+2577+9e95fe00
  • velocity AlmaLinux 8 1.7-24.module_el8.5.0+2577+9e95fe00
  • xalan-j2 AlmaLinux 8 2.7.1-38.module_el8.5.0+2577+9e95fe00
  • javassist AlmaLinux 8 3.18.1-8.module_el8.5.0+2577+9e95fe00
  • xerces-j2 AlmaLinux 8 2.11.0-34.module_el8.5.0+2577+9e95fe00
  • jackson-bom AlmaLinux 8 2.14.2-1.module_el8.10.0+3791+e0637953

almalinux advisories ALSA-2024:3061ALSA-2023:2312

  • jss Rocky Linux 8 4.11.0-1.module+el8.10.0+1816+f1a7c8eb
  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.10.0+1763+c7c02164
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+1763+c7c02164
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d
  • ldapjdk Rocky Linux 8 4.24.0-1.module+el8.10.0+1816+f1a7c8eb
  • stax-ex Rocky Linux 8 1.7.7-8.module+el8.10.0+1763+c7c02164
  • bea-stax Rocky Linux 8 1.2.0-16.module+el8.10.0+1763+c7c02164
  • pki-core Rocky Linux 8 10.15.0-1.module+el8.10.0+1816+f1a7c8eb

rocky linux advisories RLSA-2024:3061

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-36518 updated cvss 7.5

jackson-databind: denial of service via a large depth of nested objects

  • Red Hat BPM Suite 6 jackson-databind
    affected: no fix planned “Out of support scope”
  • Red Hat build of Apicurio Registry 2 jackson-databind
    affected: no fix available
  • Red Hat build of Debezium 1 jackson-databind
    affected: no fix planned “Will not fix”
  • Red Hat Integration Camel K 1 jackson-databind
    affected: no fix available
  • Red Hat Integration Service Registry jackson-databind Red Hat JBoss A-MQ 6 jackson-databind Red Hat JBoss BRMS 6 jackson-databind
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack jackson-databind
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Fuse 6 jackson-databind Red Hat JBoss Fuse Service Works 6 jackson-databind
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes jackson-databind
    affected: no fix available
show 28 more
  • Red Hat OpenShift Container Platform 3.11 jackson-databind Red Hat OpenShift Container Platform 4 openshift4/ose-logging-elasticsearch6
    affected: no fix planned “Out of support scope”
  • Red Hat support for Spring Boot jackson-databind
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8 v6.8.1-277
    fixed: vendor fix RHSA-2022:8889
  • Red Hat AMQ 7.10.0
    fixed: vendor fix RHSA-2022:5101
  • Red Hat AMQ Streams 2.2.0
    fixed: vendor fix RHSA-2022:6819
  • Red Hat AMQ Streams 2.4.0
    fixed: vendor fix RHSA-2023:3223
  • Red Hat build of Eclipse Vert.x 4.2.7
    fixed: vendor fix RHSA-2022:5029
  • Red Hat build of Quarkus 2.7.6
    fixed: vendor fix RHSA-2022:5596
  • Red Hat Data Grid 8.3.1
    fixed: vendor fix RHSA-2022:2232
  • Red Hat Enterprise Linux AppStream (v. 8) slf4j 1.7.25-4.module+el8.10.0+20993+d0f024b0, stax-ex 1.7.7-8.module+el8.10.0+20993+d0f024b0, velocity 1.7-24.module+el8.10.0+20993+d0f024b0, bea-stax 1.2.0-16.module+el8.10.0+20993+d0f024b0, xalan-j2 2.7.1-38.module+el8.10.0+20993+d0f024b0, javassist 3.18.1-8.module+el8.10.0+20993+d0f024b0, +30 more
    fixed: vendor fix RHSA-2024:3061
  • Red Hat Enterprise Linux AppStream (v. 9) jackson-databind 2.14.1-2.el9, pki-jackson-databind 2.14.1-2.el9
    fixed: vendor fix RHSA-2023:2312
  • Red Hat Fuse 7.11
    fixed: vendor fix RHSA-2022:5532
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jackson-databind 2.12.6.1-1.redhat_00003.1.el7eap
    fixed: vendor fix RHSA-2022:4918
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jackson-databind 2.12.6.1-1.redhat_00003.1.el8eap
    fixed: vendor fix RHSA-2022:4919
  • Red Hat JBoss Enterprise Application Platform jackson-databind 2.12.6.1-redhat-00003
    fixed: vendor fix RHSA-2022:4922
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.11-4.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.63-2.Final_redhat_00003.1.ep7.el7, eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7, eap7-glassfish-el 3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate 5.1.17-3.Final_redhat_00004.1.ep7.el7, eap7-netty-all 4.1.63-2.Final_redhat_00003.1.ep7.el7, +19 more
    fixed: vendor fix RHSA-2025:9582
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.14-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.63-5.Final_redhat_00003.1.el7eap, eap7-jackson-core 2.10.4-3.redhat_00006.1.el7eap, eap7-undertow 2.0.41-4.SP5_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-5.Final_redhat_00003.1.el7eap, eap7-jackson-databind 2.10.4-5.redhat_00006.1.el7eap, +37 more
    fixed: vendor fix RHSA-2025:9583
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2022:6787
  • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak 15.0.8-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 15.0.8-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2022:6782
  • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak 15.0.8-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 15.0.8-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2022:6783
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2022:7409
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2022:7410
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7 1-5.el9sso, rh-sso7-runtime 1-5.el9sso, rh-sso7-javapackages-tools 6.0.0-7.el9sso, rh-sso7-python3-javapackages 6.0.0-7.el9sso, rh-sso7-javapackages-filesystem 6.0.0-7.el9sso, rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el9sso, +1 more
    fixed: vendor fix RHSA-2022:7411
  • Red Hat Single Sign-On 7.6.1
    fixed: vendor fix RHSA-2022:7417
  • Red Hat RHAF Camel-K 1.8
    fixed: vendor fix RHSA-2022:6407
  • Red Hat RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch6-rhel8 v6.8.1-265
    fixed: vendor fix RHSA-2022:7435
  • Red Hat RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch6-rhel8 v6.8.1-273
    fixed: vendor fix RHSA-2022:8781
  • Red Hat RHOL 5.6 for RHEL 8 openshift-logging/elasticsearch6-rhel8 v6.8.1-285
    fixed: vendor fix RHSA-2023:0264

1 more fixed, 11 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
14 mo ago

Exploit prediction

4.86% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven com.fasterxml.jackson.core:jackson-databind
>=2.13.0, <2.13.2.1
<2.12.6.1
2.13.2.1
2.12.6.1

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.