Search/CVE-2020-9546
● CVE — Critical

CVE-2020-9546

Vendordebian, fasterxml, netapp, oracleProductdebian linux, jackson-databind, active iq unified manager, agile product lifecycle management, jd edwards enterpriseone tools, financial services analytical applications infrastructure, financial services price creation and discovery, banking platform, communications diameter signaling router, communications instant messaging server, enterprise manager base platform, agile plm, communications element manager, communications session report manager, communications session route manager, insurance policy administration j2ee, global lifecycle management opatch, jd edwards enterpriseone orchestrator, banking digital experience, communications evolved communications application server, communications calendar server, communications contacts server, communications network charging and control, autovue for agile product lifecycle management, financial services institutional performance analytics, financial services retail customer analyticsDiscoveredMar 2, 2020UpdatedOct 7, 2026

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

CVSS v3.1
9.8 CRITICAL
EPSS
4.58%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
Timeline
disclosure → media coverage
Mar 2, 2020
Disclosure — published as a CVE record. · last revised by NVD Oct 7, 2026