CVE-2020-9546

Name: CVE-2020-9546
Creator: NVD / NIST
Published: 2020-03-02T04:15:10.843+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 4.58%

Last modified Jun 17, 2026

CVE-2020-9546 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).. EPSS estimates a 4.58% chance of exploitation in the next 30 days.

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

4.58%

90.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-502

Affected Software

Vendor	Product	Versions
Fasterxml	Jackson-Databind	>= 2.0.0, < 2.7.9.7
Fasterxml	Jackson-Databind	>= 2.8.0, < 2.8.11.6
Fasterxml	Jackson-Databind	>= 2.9.0, < 2.9.10.4
Netapp	Active Iq Unified Manager	>= 7.3
Netapp	Active Iq Unified Manager	>= 9.5
Debian	Debian Linux	8.0
Oracle	Agile Plm	9.3.6
Oracle	Autovue For Agile Product Lifecycle Management	21.0.2
Oracle	Banking Digital Experience	18.1
Oracle	Banking Digital Experience	18.2
Oracle	Banking Digital Experience	18.3
Oracle	Banking Digital Experience	19.1
Oracle	Banking Digital Experience	19.2
Oracle	Banking Digital Experience	20.1
Oracle	Banking Platform	>= 2.4.0, <= 2.9.0
Oracle	Communications Calendar Server	8.0.0.4.0
Oracle	Communications Contacts Server	8.0.0.4.0
Oracle	Communications Contacts Server	8.0.0.5.0
Oracle	Communications Diameter Signaling Router	>= 8.0.0, <= 8.2.2
Oracle	Communications Element Manager	>= 8.2.0, <= 8.2.2
Oracle	Communications Evolved Communications Application Server	7.1
Oracle	Communications Instant Messaging Server	10.0.1.4.0
Oracle	Communications Network Charging And Control	>= 12.0.0, <= 12.0.3
Oracle	Communications Network Charging And Control	6.0.1
Oracle	Communications Session Report Manager	>= 8.2.0, <= 8.2.2
Oracle	Communications Session Route Manager	>= 8.2.0, <= 8.2.2
Oracle	Enterprise Manager Base Platform	13.3.0.0
Oracle	Enterprise Manager Base Platform	13.4.0.0
Oracle	Financial Services Analytical Applications Infrastructure	>= 8.0.6, <= 8.1.0
Oracle	Financial Services Institutional Performance Analytics	8.0.6
Oracle	Financial Services Institutional Performance Analytics	8.0.7
Oracle	Financial Services Institutional Performance Analytics	8.1.0
Oracle	Financial Services Institutional Performance Analytics	8.7.0
Oracle	Financial Services Price Creation And Discovery	8.0.6
Oracle	Financial Services Price Creation And Discovery	8.0.7
Oracle	Financial Services Retail Customer Analytics	8.0.6
Oracle	Global Lifecycle Management Opatch	< 12.2.0.1.20
Oracle	Insurance Policy Administration J2ee	11.0.2.25
Oracle	Insurance Policy Administration J2ee	11.1.0.15
Oracle	Jd Edwards Enterpriseone Orchestrator	< 9.2.4.2
Oracle	Jd Edwards Enterpriseone Tools	< 9.2.4.2
Oracle	Primavera Unifier	>= 17.7, <= 17.12
Oracle	Primavera Unifier	16.1
Oracle	Primavera Unifier	16.2
Oracle	Primavera Unifier	18.8
Oracle	Primavera Unifier	19.12
Oracle	Retail Merchandising System	15.0
Oracle	Retail Sales Audit	14.1
Oracle	Retail Service Backbone	14.1
Oracle	Retail Service Backbone	15.0

Showing 50 of 58 affected configurations. See NVD for the full list.

References

https://github.com/FasterXML/jackson-databind/issues/2631Patch, Third Party Advisory
https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3EThird Party Advisory
https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00008.htmlMailing List, Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062Third Party Advisory
https://security.netapp.com/advisory/ntap-20200904-0006/Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2631Patch, Third Party Advisory
https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3EThird Party Advisory
https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3EIssue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00008.htmlMailing List, Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062Third Party Advisory
https://security.netapp.com/advisory/ntap-20200904-0006/Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Timeline

Published: Mar 2, 2020
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2020-9546?

How severe is CVE-2020-9546?

CVE-2020-9546 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 4.58% probability of exploitation in the next 30 days.

How do I fix CVE-2020-9546?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-9546?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST