CVE-2020-35491: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-35491DEBIAN-CVE-2020-35491CGA-26f9-hfq5-gw96CGA-282m-33fr-78mjCGA-28r5-qjmq-72j2CGA-2cm7-xcjf-rh4qCGA-2fg4-4c54-vq63CGA-2fqx-w9f8-vfrpCGA-2fx3-3rx3-7jfxCGA-2hgv-xqj9-fcjmCGA-2p27-p6vm-42mrCGA-2pjp-mhq5-m77fCGA-2qvj-qfvg-8j9fCGA-37p3-w2fm-3rfgCGA-38qq-x383-54wgCGA-3c7c-whqp-6p4jCGA-3mrr-3j8c-g2mpCGA-3vgg-5942-j88xCGA-4222-7j8c-9f7pCGA-42hm-cjm3-fcvrCGA-45cc-hxrg-27p8CGA-4cmg-q875-r6rvCGA-4j6f-7w6j-6fjhCGA-4jgh-53ff-48p8CGA-4r95-5m79-8jmpCGA-4v7x-76rr-f22jCGA-55vg-4qwh-v8f8CGA-5853-8x6p-v8vxCGA-5wh5-wwh8-h7w6CGA-63j6-qxf6-pv44CGA-67qr-w2h6-8f9qCGA-6p63-334g-c8c8CGA-6qj7-gwjf-x2frCGA-6qrq-7xm4-3g2wCGA-6v56-q6x9-28ghCGA-74r7-c7mv-5v3rCGA-7863-mfq3-jw8rCGA-78gv-6wx4-h42gCGA-795x-4wm5-p9g8CGA-79pg-9c74-2vq4CGA-7cwq-gxgq-f372CGA-7fh6-m74q-c8m3CGA-7fxv-cqc2-r53fCGA-7gvv-x523-prjgCGA-7hjw-j7qq-c87jCGA-7v8g-7r7x-q3h5CGA-85r2-9pcg-w4jjCGA-8648-f43j-86j9CGA-89h4-9m93-mgfxCGA-8gxg-cp5v-4mpqCGA-8hvr-ppmr-gpx5CGA-8j76-jc9f-r2hfCGA-8jx5-c294-r4gxCGA-8mv9-r87w-7g6qCGA-8x68-g27q-492vCGA-8x9v-w92w-ccf8CGA-993g-4v7m-8887CGA-99cw-q87m-m8vhCGA-99qv-jcc4-968hCGA-9f8m-7fgw-wh53CGA-9h9m-mvx7-68qxCGA-9hqw-pw85-3qmrCGA-9q9j-mw29-mx47CGA-9qcw-rfhp-6fqpCGA-9w6r-vqjh-q9c3CGA-9x7f-vpxh-qv6hCGA-9xv7-qg36-x256CGA-c2v2-mrrr-fc4xCGA-c67j-6vjh-qrr7CGA-c6qv-v8pv-fhv5CGA-c8rc-3g3g-rmv4CGA-cm6r-95j9-rrc4CGA-cr27-qxxx-mgw6CGA-cr7r-qwpp-2h43CGA-cw6r-cxvc-544gCGA-cwcp-7j6r-6vw7CGA-cwf6-95h8-6v7vCGA-fcjf-6gcc-6299CGA-fgjm-hggp-wwqhCGA-fh52-393j-9rf7CGA-fr78-phrm-pj3xCGA-frgm-396f-p27xCGA-g2hv-jjhr-v8c7CGA-g4vc-x2cq-x42xCGA-h42h-c67h-78w8CGA-h6cg-rm43-hh5gCGA-hc69-9h48-h4gpCGA-hhrh-jfjm-j55rCGA-hj4v-95fp-fx54CGA-hw39-2x3h-26qhCGA-jm6r-gx9g-52rfCGA-jmqg-9595-pw78CGA-jpgg-v4mx-gwg6CGA-jrmq-v5jw-fxp9CGA-jwm3-9vjg-hhr9CGA-m265-9xj2-hgp2CGA-m6cc-5rh2-944gCGA-m77c-8g9m-fjm6CGA-mg5p-vx8q-64j7CGA-mhrp-j24w-4793CGA-mppx-235r-xjg2CGA-mvp9-6p7g-7x43CGA-mxxg-83g3-whr4CGA-p3cg-vpxh-qcmhCGA-pcrj-8q2r-j6vfCGA-ph9v-jfgx-gp8qCGA-pphw-75m8-2qpvCGA-pvcp-33v3-w6q3GHSA-r3gr-cxrf-hg25CGA-q32w-vg97-mxjgCGA-qfrf-95xx-qv44CGA-qgp2-6333-m786CGA-qr5w-54g8-95wqCGA-qr73-32q4-8gv5CGA-qv28-pf34-4v4hCGA-r24h-9g9p-c5mvCGA-r2p9-m4hv-8933CGA-r3gx-5p8c-92h5CGA-r58m-39wh-955wCGA-r5vw-2c9c-gcvgCGA-rff4-g878-c25mCGA-rh99-wp48-2qfcCGA-rjf2-6ghh-87f7CGA-rv3v-xxpm-rcprCGA-v38g-j8m3-cff4CGA-v56r-23r2-gwqfCGA-v9gp-gvmv-r3vmCGA-vc34-pv87-mjq6CGA-vhr8-qmcp-qvq8CGA-vpr7-q3p7-5gfmCGA-vvpm-337c-8v4cCGA-vw48-rvgq-6mm4CGA-w24j-mc2c-cgggCGA-w27x-qg7j-6ghxCGA-w3qc-qrgg-cm2cCGA-w4c7-842f-p589CGA-w4fj-8pfc-62gvCGA-w7c7-9g6x-6wpgCGA-wc6q-vr8j-rqqhCGA-wmfp-ffx8-qx8mCGA-x2wx-g9gh-hchxCGA-x3g4-45vr-g4xrCGA-x3vj-69q7-585rCGA-x3w9-5h48-f399CGA-x45c-8hg3-7xwqCGA-x737-fpv5-73ghCGA-x9f6-j5vf-q2p6CGA-xjq4-9fjg-92mpCGA-xp88-j7v9-58rfCGA-xp9j-55cm-2632CGA-xpf7-8wxq-w4c3CGA-xrqh-wj7h-ghjhCGA-xvvp-jq53-5c76CGA-xxjg-6w7q-hwm2
Published 17-12-2020Last modified 08-10-2026
Vulnerability summary
CVE-2020-35491 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 7.75% chance of exploitation in the next 30 days, higher than 94.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
7.75%
0%100%
Low · -1.88 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 17-12-2020PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
7.75%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
-1.88 pp
From 9.63% on 19-09-2026
19-09-202619-10-2026
EPSS score7.75%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cowtowncoder.medium.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle23 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_platform2.6.2 | 2.7.0 | 2.7.1 | 2.8.0 | 2.9.0 | 2.10.0
- banking_treasury_management14.4
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.0.0, < 2.9.10.8
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.9.10.8
Netapp1 product
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 97 products
References
17 links- cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCREPORTEVIDENCEWEBExploitTechnical DescriptionThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2986X Refsource MISCREPORTAdvisoryWEBThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
