A deserialization flaw was discovered in jackson-databind through 2.9.10.4.
Priority HIGH 70CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.036 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed com.fasterxml.jackson.core:jackson-databind (Maven): 2.9.10.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | before 2.9.10.4 | 2.9.10.4 | Patch available | GHSA-rpr3-cw39-3pxh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected before 2.9.10.4 Fixed in 2.9.10.4 Patch available GHSA-rpr3-cw39-3pxh
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | before 2.9.10.4 | Vulnerable | FasterXML |
| cpe:2.3:a:fasterxml:jackson-databind:2.10.0:prerelease1:*:*:*:*:*:* | 2.10.0 prerelease1 | Vulnerable | FasterXML |
| cpe:2.3:a:fasterxml:jackson-databind:2.10.0:prerelease2:*:*:*:*:*:* | 2.10.0 prerelease2 | Vulnerable | FasterXML |
| cpe:2.3:a:fasterxml:jackson-databind:2.10.0:prerelease3:*:*:*:*:*:* | 2.10.0 prerelease3 | Vulnerable | FasterXML |
| cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions before 2.9.10.4 Vulnerable ·FasterXML
- cpe:2.3:a:fasterxml:jackson-databind:2.10.0:prerelease1:*:*:*:*:*:* Versions 2.10.0 prerelease1 Vulnerable ·FasterXML
- cpe:2.3:a:fasterxml:jackson-databind:2.10.0:prerelease2:*:*:*:*:*:* Versions 2.10.0 prerelease2 Vulnerable ·FasterXML
- cpe:2.3:a:fasterxml:jackson-databind:2.10.0:prerelease3:*:*:*:*:*:* Versions 2.10.0 prerelease3 Vulnerable ·FasterXML
- cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-rpr3-cw39-3pxh com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-10650
- 2026-10-03 Alias added: GHSA-rpr3-cw39-3pxh
References
Patch 4
Advisory 4
Other 5
- https://github.com/luisgarciacheckmarx/LGV_onefile/issues/19
- https://github.com/FasterXML/jackson-databind/pull/2864
- https://github.com/FasterXML/jackson-databind
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20230818-0007
Sources
- CVE-2020-10650 · CVE Program
- CVE-2020-10650 · NVD
- FIRST EPSS
- GHSA-rpr3-cw39-3pxh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences