CVE-2020-9546

—

CVSS 3.1

9.8 critical

EPSS

5%p91

Published

Mar 2, 2020 (Mar 2, 2020)

Modified

Aug 25, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Vendors: fasterxml netapp debian oracle
Products: jackson-databind, active iq unified manager, debian linux, agile product lifecycle management, autovue for agile product lifecycle management, banking digital experience, banking platform, communications calendar server, communications contacts server, communications diameter signaling router, communications element manager, communications evolved communications application server
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.6%)

In the news0 stories

No ingested article mentions this CVE yet.