CVE-2020-36186: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-36186DEBIAN-CVE-2020-36186CGA-25q3-5265-pfmqCGA-25qw-hmm6-w629CGA-2953-j9m3-688wCGA-2jhj-r5v7-5526CGA-2m8j-9p4r-c5xfCGA-2mhc-xhx2-4cg8CGA-33fm-pmvg-r2q4CGA-353h-7p4p-v2r6CGA-39q9-2q8r-jfgwCGA-3rh2-m8pr-m7hmCGA-3wh8-9vpw-mw2mCGA-423q-x4j8-7927CGA-4258-3h3c-4436CGA-4742-4fgq-hx67CGA-4c86-7mq7-5f39CGA-4cxc-g8xp-cq93CGA-4hxp-mvpc-j728CGA-4j52-5gx8-4v2fCGA-4jg2-4r78-r4vgCGA-4rwx-xv4c-7353CGA-4vm2-2v5g-2mfrCGA-58cw-jw54-whh4CGA-58m6-j5hm-7vf5CGA-5g56-hrqp-w526CGA-5q7q-qh8g-pvj7CGA-5qfh-5rw5-8jwpCGA-5w3h-82hr-wh8hCGA-63h5-w2v5-qh7xCGA-64r7-3g2c-pc83CGA-68h6-hfv4-jv5hCGA-68pq-xf6r-5pqcCGA-6cwc-2j4j-6hp5CGA-6gwq-qjwr-fg9wCGA-6jq5-jmq2-36q9CGA-6pf8-f3q2-4vg8CGA-6rfq-vcff-8329CGA-6xj4-m765-r336CGA-72fc-fff5-469mCGA-7936-q885-c4rfCGA-7c3g-v6fv-x3rcCGA-7hr8-86mw-cm7gCGA-7jrh-hgc4-mjg5CGA-7m29-wcwq-8rmqCGA-7vfh-jx2h-wqf7CGA-8c4x-m2x2-5262CGA-8qrx-72hj-2j36CGA-8w7f-p9vw-22p2CGA-92pr-rw2m-qj9hCGA-95c4-mx9p-v297CGA-96xw-47mx-mgvfCGA-9gff-87hv-jq9cCGA-9h56-8vx2-gxf2CGA-9mr5-jrxg-8p2pCGA-9q7g-hwqc-f2hhCGA-9xrv-q4q6-wjc4CGA-c4rx-wjg2-hgj8CGA-c56q-pqpq-2p9wCGA-c5p2-3jpm-wm2qCGA-c9f4-f599-5ff9CGA-cf2v-hw22-8v6fCGA-cfcv-j5w2-699gCGA-cgwh-69j4-vwg5CGA-chjh-3rjv-mvfjCGA-cj7r-2mm4-jp58CGA-cx75-7rj4-gxvrCGA-f2gq-27pc-4fgfCGA-f3wj-3xr7-q365CGA-f534-2hc6-6xghCGA-f586-wv77-4vwvCGA-fh97-5gr6-4984CGA-fr49-w789-v3ffCGA-g8qp-gvc7-x852CGA-g9cg-pvg4-7658CGA-gg54-x97h-8928CGA-gj7p-x3c8-wq98CGA-gmj9-5hw2-2553CGA-gq3g-xr4j-8gf3CGA-gqg5-9279-f5pgCGA-gr22-fxgw-6x8hCGA-h95r-4j6g-25h8CGA-h9fc-rq34-r4q3CGA-hcgf-x32x-4vwwCGA-hgxq-c4x7-wgw3CGA-hqmc-w4g6-333pCGA-hvxh-8c3v-6cxjCGA-j4c2-89q8-8qxwCGA-j83p-66jf-c434CGA-j8v2-62m7-r3v3CGA-jc99-8887-vm68CGA-jhqv-m49q-wmv6CGA-jw88-rgf4-2xcxCGA-jxfq-rhp9-w5x3CGA-m39x-7jv4-5fr7CGA-m573-fmr3-6p3mCGA-m7mm-8qgf-85r8CGA-m8pq-vp2w-5xc8CGA-m9cq-wxx8-hj8gCGA-m9mr-c2qq-7m3rCGA-mc3v-wj9h-c75pCGA-mfmx-4cpj-g6x3CGA-mj2f-xvfg-37hhCGA-mqj5-jcgm-w226CGA-mrqf-g9hm-xg6wCGA-p2jj-cqx8-9xg3CGA-p4pv-g6qr-xgr3CGA-p6qc-844q-26p7CGA-p7f8-8vxp-52gcCGA-p8f9-wpcg-h3mfCGA-pf8c-j4rg-fh55CGA-phcp-fjcq-pmhpCGA-pm96-jw7j-vmhrGHSA-v585-23hc-c647CGA-q3gm-vc7q-4q5cCGA-q45q-pmcq-554gCGA-q5qq-6j72-hhjhCGA-q657-r64j-c942CGA-q6xm-vjwf-j2hvCGA-qc5m-fw28-546qCGA-qcxf-3r66-f7fhCGA-qh5p-qxqx-76qjCGA-qjr9-jx2p-99cgCGA-qqf7-m872-qv45CGA-r53r-j785-8c4wCGA-rf96-mcx4-fq3gCGA-rfj8-3mxg-9pc9CGA-rfrx-8h3x-55r9CGA-rh92-4qp3-q8rfCGA-rj2w-64v9-whjjCGA-rpf8-vxvm-r8xqCGA-rww4-2pwv-53hqCGA-rxxp-qcvx-pvc4CGA-v56j-v9xr-p77qCGA-v7h8-x74g-f8rpCGA-v9p2-8xg2-54vhCGA-vc2c-p6hm-q7mmCGA-vcfc-gp8m-cqjcCGA-vg36-v2qp-xw8pCGA-vj37-wrpv-56vmCGA-vvww-qv5w-vjmrCGA-w44w-xr4h-5x2wCGA-w7g7-mr7r-6j7wCGA-w8xx-mghx-c25qCGA-wc6f-6w9g-gjr8CGA-wff5-prr5-86vxCGA-wjjj-qcgx-9v2rCGA-wq5q-fgp3-9749CGA-wxqv-37h6-28x7CGA-x7ww-p47v-fgm5CGA-x87g-9qww-hqchCGA-xf6m-m7fx-fj9xCGA-xfmq-23c6-qv3xCGA-xmp3-99mf-pmq9
Published 06-01-2021Last modified 08-10-2026
Vulnerability summary
CVE-2020-36186 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 4.24% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
4.24%
0%100%
Low · -0.98 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 06-01-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
4.24%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
-0.98 pp
From 5.22% on 18-09-2026
18-09-202618-10-2026
EPSS score4.24%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cowtowncoder.medium.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle41 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_corporate_lending_process_management14.2 | 14.3 | 14.5
- banking_credit_facilities_process_management14.2 | 14.3 | 14.5
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Netapp2 products
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.0.0, < 2.9.10.8
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.8
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 116 products
References
17 links- cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCREPORTEVIDENCEWEBExploitTechnical DescriptionThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2997X Refsource MISCREPORTWEBIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
