jackson-databind

CVE-2020-25649

HIGH 7.5

At a glance

Source: NVD
EPSS: EPSS 17.71 % · percentile 97 (2026-10-29)
State: PUBLISHED
Published: 2020-12-03 16:16 UTC
Updated: 2026-10-08 19:42 UTC
Assigner: redhat
NVD status: Modified

Search on…

Description

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Weaknesses (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N	NVD · nvd@nist.gov (Primary)

Advisories

GHSA-288c-cq4h-88gq — XML External Entity (XXE) Injection in Jackson Databind

European references

ENISA EUVD · EUVD-2021-0525
GCVE · GCVE-0-2020-25649

CERT-FR advisories

CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2026-AVI-0556 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0500 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
CERTFR-2024-AVI-0841 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0459 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0040 — Multiples vulnérabilités dans Atlassian Confluence et Jira · cert.ssi.gouv.fr
CERTFR-2023-AVI-0839 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-871 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-568 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2021-AVI-943 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2021-AVI-556 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr
CERTFR-2021-AVI-101 — Multiples vulnérabilités dans IBM Spectrum Protect Plus · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* ≥ 2.6.0 < 2.6.7.4
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* ≥ 2.9.0 < 2.9.10.7
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* ≥ 2.10.0 < 2.10.5.1
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* ≤ 1.6.1
cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:* < 0.12.0
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:*
cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* ≥ 18.1 ≤ 18.3
cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_treasury_management:4.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* < 21.1.2
cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:commerce_platform:*:*:*:*:*:*:*:* ≥ 11.3.0 ≤ 11.3.2
cpe:2.3:a:oracle:commerce_platform:11.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_convergent_charging_controller:12.0.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
+33 more

Affected products

Product	Versions
jackson-databind	affected jackson-databind-2.11.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ jackson-databind