CVE-2020-36518 Deeply nested json in jackson-databind
Attackers can cause a denial of service via stack overflow by sending deeply nested JSON objects to applications using this Java library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36518?
CVE-2020-36518 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 11 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Weakness: CWE-787
Which versions are affected by CVE-2020-36518?
4 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind. It affects 36 products.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | All versions | 2.12.6.1 |
com.fasterxml.jackson.core:jackson-databind Maven | All versions | 2.12.6.1 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.13.0 | 2.13.2.1 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.13.0 | 2.13.2.1 |
Linux distribution packages (36)
apache-commons-collections AlmaLinux:8 | All versions | 3.2.2-10.module_el8.5.0+2577+9e95fe00 |
apache-commons-lang AlmaLinux:8 | All versions | 2.6-21.module_el8.5.0+2577+9e95fe00 |
apache-commons-net AlmaLinux:8 | All versions | 3.6-3.module_el8.5.0+2577+9e95fe00 |
bea-stax-api AlmaLinux:8 | All versions | 1.2.0-16.module_el8.5.0+2577+9e95fe00 |
fasterxml-oss-parent AlmaLinux:8 | All versions | 49-1.module_el8.10.0+3791+e0637953 |
glassfish-fastinfoset AlmaLinux:8 | All versions | 1.2.13-9.module_el8.5.0+2577+9e95fe00 |
glassfish-jaxb-api AlmaLinux:8 | All versions | 2.2.12-8.module_el8.5.0+2577+9e95fe00 |
glassfish-jaxb-core AlmaLinux:8 | All versions | 2.2.11-12.module_el8.10.0+3791+e0637953 |
glassfish-jaxb-runtime AlmaLinux:8 | All versions | 2.2.11-12.module_el8.10.0+3791+e0637953 |
glassfish-jaxb-txw2 AlmaLinux:8 | All versions | 2.2.11-12.module_el8.10.0+3791+e0637953 |
jackson-annotations AlmaLinux:8 | All versions | 2.14.2-1.module_el8.10.0+3791+e0637953 |
jackson-bom AlmaLinux:8 | All versions | 2.14.2-1.module_el8.10.0+3791+e0637953 |
jackson-core AlmaLinux:8 | All versions | 2.14.2-1.module_el8.10.0+3791+e0637953 |
jackson-databind AlmaLinux:8 | All versions | 2.14.2-1.module_el8.10.0+3791+e0637953 |
jackson-jaxrs-json-provider AlmaLinux:8 | All versions | 2.14.2-1.module_el8.10.0+3791+e0637953 |
jackson-jaxrs-providers AlmaLinux:8 | All versions | 2.14.2-1.module_el8.10.0+3791+e0637953 |
jackson-module-jaxb-annotations AlmaLinux:8 | All versions | 2.14.2-2.module_el8.10.0+3791+e0637953 |
jackson-modules-base AlmaLinux:8 | All versions | 2.14.2-2.module_el8.10.0+3791+e0637953 |
jackson-parent AlmaLinux:8 | All versions | 2.14-1.module_el8.10.0+3791+e0637953 |
jakarta-commons-httpclient AlmaLinux:8 | All versions | 1:3.1-28.module_el8.5.0+2577+9e95fe00 |
javassist AlmaLinux:8 | All versions | 3.18.1-8.module_el8.5.0+2577+9e95fe00 |
javassist-javadoc AlmaLinux:8 | All versions | 3.18.1-8.module_el8.5.0+2577+9e95fe00 |
pki-servlet-engine AlmaLinux:8 | All versions | 1:9.0.62-1.module_el8.10.0+3791+e0637953 |
relaxngDatatype AlmaLinux:8 | All versions | 2011.1-7.module_el8.5.0+2577+9e95fe00 |
slf4j AlmaLinux:8 | All versions | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
slf4j-jdk14 AlmaLinux:8 | All versions | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
stax-ex AlmaLinux:8 | All versions | 1.7.7-8.module_el8.5.0+2577+9e95fe00 |
velocity AlmaLinux:8 | All versions | 1.7-24.module_el8.5.0+2577+9e95fe00 |
xalan-j2 AlmaLinux:8 | All versions | 2.7.1-38.module_el8.5.0+2577+9e95fe00 |
xerces-j2 AlmaLinux:8 | All versions | 2.11.0-34.module_el8.5.0+2577+9e95fe00 |
xml-commons-apis AlmaLinux:8 | All versions | 1.4.01-25.module_el8.5.0+2577+9e95fe00 |
xml-commons-resolver AlmaLinux:8 | All versions | 1.2-26.module_el8.5.0+2577+9e95fe00 |
xmlstreambuffer AlmaLinux:8 | All versions | 1.5.4-8.module_el8.5.0+2577+9e95fe00 |
xsom AlmaLinux:8 | All versions | 0-19.20110809svn.module_el8.5.0+2577+9e95fe00 |
pki-jackson-databind AlmaLinux:9 | All versions | 2.14.1-2.el9 |
apache-commons-collections Red Hat:enterprise_linux:8::appstream | All versions | 0:3.2.2-10.module+el8.10.0+20993+d0f024b0 |
Products include Debian Debian Linux, Fasterxml Jackson-Databind, Netapp Active Iq Unified Manager, Netapp Cloud Insights Acquisition Unit, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation and 30 more.
How do I fix CVE-2020-36518?
Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.12.6.1 or 2.13.2.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-36518 being exploited?
There is no known exploitation of CVE-2020-36518 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2023:2312, ALSA-2024:3061, CLEANSTART-2026-TR04236, CLSA-2025-1760018305, DEBIAN-CVE-2020-36518, DLA-2990-1 and 10 more.