CVE-2020-35491

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

• CWE-502

• https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062Exploit, Technical Description, Third Party Advisory
• https://github.com/FasterXML/jackson-databind/issues/2986Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210122-0005/Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062Exploit, Technical Description, Third Party Advisory
• https://github.com/FasterXML/jackson-databind/issues/2986Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210122-0005/Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Dec 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35482SolarWinds Serv-U before 15.2.2 allows authenticated reflect…5.4
• CVE-2020-35483AnyDesk before 6.1.0 on Windows, when run in portable mode o…7.8
• CVE-2020-35488The fileop module of the NXLog service in NXLog Community Ed…7.5
• CVE-2020-35489The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 …10
• CVE-2020-3549A vulnerability in the sftunnel functionality of Cisco Firep…8.1
• CVE-2020-35490FasterXML jackson-databind 2.x before 2.9.10.8 mishandles th…8.1
• CVE-2020-35492A flaw was found in cairo's image-compositor.c in all versio…7.8
• CVE-2020-35493A flaw exists in binutils in bfd/pef.c. An attacker who is a…5.5
• CVE-2020-35494There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker…6.1
• CVE-2020-35495There's a flaw in binutils /bfd/pef.c. An attacker who is ab…5.5
• CVE-2020-35496There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c …5.5
• CVE-2020-35497A flaw was found in ovirt-engine 4.4.3 and earlier allowing …6.5