CVE-2020-36187: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-36187DEBIAN-CVE-2020-36187CGA-29fq-jqf4-4c6mCGA-2c4p-69p5-xjvvCGA-2c6m-xxh9-hq86CGA-2fhh-gqcw-ff2wCGA-2mgh-rr5v-cc6mCGA-2mm6-cv38-qw9jCGA-2rm4-pgcc-jgmcCGA-2v28-3cp6-g4c3CGA-32c7-4hv7-8gr4CGA-3cwr-w33r-jc8wCGA-3f24-pg7q-j5f3CGA-3hmj-rm3x-g2mjCGA-3j68-c3rh-rcq4CGA-3pvp-74w6-f83vCGA-3r5m-vpmj-672fCGA-46xc-mpm9-4hf4CGA-478m-c793-9ww3CGA-4g4h-vvmp-xrc2CGA-4hfx-g98v-5v47CGA-4hw8-fc8p-xf98CGA-4m4c-xggp-mhp7CGA-4pgg-qvw2-mvvxCGA-4r7v-rx7h-v453CGA-4vfm-4qgx-mmqvCGA-4xf5-h2p4-3f7qCGA-4xfv-gw9m-cf3vCGA-5583-cw26-gvrcCGA-5769-3p8p-99g9CGA-5836-gc73-vc49CGA-584x-r4r7-8pxxCGA-58qj-54jc-vfxcCGA-59xh-89xh-p4wvCGA-5gc4-7wq3-x92rCGA-5gc4-x78q-3wrxCGA-5j46-62jj-4vqmCGA-63p8-jfqh-wjc9CGA-6735-7c5q-45mcCGA-6g6j-c8q4-9j8pCGA-6jch-xxhx-q825CGA-6jq7-5rfg-4qgrCGA-6q49-653w-c64mCGA-6w7g-65fj-7mf8CGA-6wgp-rx6j-59x5CGA-7355-xch7-c9wpCGA-77j2-x9w3-wf9vCGA-7jr7-xx7r-w7h2CGA-7prr-93c9-9wfwCGA-7rjf-wgjq-4mc5CGA-7wm9-4gcw-fhx6CGA-7x8x-r2fg-64v4CGA-7xm2-jqm8-xj75CGA-89h6-p4r7-g67wCGA-89pc-q3c3-8r5gCGA-8qm7-p848-94j7CGA-8r2c-3x6r-xhgqCGA-8x3m-47q5-qp2rCGA-95mm-rjq8-4wq2CGA-9f8f-xqc4-vw8rCGA-9mp2-cp47-xvvxCGA-9rmf-xhqp-r8xvCGA-9xjj-wv9h-rfm3CGA-c4cr-vr29-962cCGA-c93c-2h5f-vr2hCGA-c9vj-hwh6-8c6rCGA-cfjm-7fg6-rm6jCGA-cg79-gw37-pvh5CGA-ch5g-3f6w-4q8gCGA-fc2c-r8j8-hg58CGA-fg4r-w9c4-72pgCGA-fg96-q297-462cCGA-fgc4-vv79-6mrmCGA-fmc6-mfp3-m9x4CGA-fr5g-rwf7-hc54CGA-frvv-gc77-2xxhCGA-fvc7-v4fr-mr34CGA-g385-4hc4-57vxCGA-gf5c-p96w-9rm8CGA-gh3p-9x4j-xvphCGA-gmhw-jg62-854jCGA-gq4g-gq9g-pxq6CGA-gqpv-hhgc-cfr8CGA-h5xp-qw52-j5m8CGA-hg6h-mv55-c527CGA-hqfg-f296-wghgCGA-hrgg-f2q8-pvp4CGA-hw8c-g9rc-jcp5CGA-hx32-fvr6-fgj4CGA-j4qq-r3wv-737qCGA-j8ch-99cw-9767CGA-j8pr-f9j2-w66cCGA-j8rf-c3h8-m3qjCGA-jgj5-5m4c-475vCGA-jjvv-rvxg-4wfcCGA-jq76-phmp-7q6wCGA-jvgx-v3cj-38qfCGA-jw59-p557-28mfCGA-m5v6-r4mv-v9jwCGA-m6ph-h5mv-275qCGA-m8rc-7hmm-c564CGA-mf46-f9cj-h8wwCGA-mm2p-p535-m57fCGA-mv6r-w824-w548CGA-mvqr-6rx2-hcg6CGA-mxw6-6cmj-83qrCGA-p2rf-8hjg-wphpCGA-p3ww-j44c-fgf2CGA-p4q7-xw92-p3hvCGA-p54q-jr73-x2w5CGA-p57g-94pc-7889CGA-p6gc-mmwc-h9qpCGA-pcm7-vmvr-654cCGA-pv29-5p3j-wh35CGA-pw33-66g9-xx7jGHSA-r695-7vr9-jgc2CGA-pwc3-hxx6-298fCGA-q6rg-8rr5-hr4rCGA-q8cf-xx23-c6mwCGA-q8vr-5whp-v4xgCGA-q9q6-hc58-xfmvCGA-qg4v-jv53-w36qCGA-qgp9-wq8r-cg24CGA-qm72-8vv2-v8mgCGA-qmqw-77x5-pcw4CGA-qq36-4pfx-54xhCGA-qq47-8m4v-498vCGA-qqj2-qvxj-74f9CGA-r2g3-v46m-m5cqCGA-r3f9-vqh6-8gjcCGA-r5r6-2qc2-99cpCGA-r898-v7mv-gr55CGA-r9gc-39mr-p7q4CGA-rcjg-w59m-hp8pCGA-rfqv-5hpr-pv2pCGA-rpp5-x6vj-cfj4CGA-v29q-qfv7-gvqvCGA-v5fr-frmx-62wxCGA-v5qj-m64g-8789CGA-vcwx-qmp9-j549CGA-vp8h-fqpr-w65gCGA-vr45-hqcq-wr29CGA-vr6x-hj2h-7pwfCGA-vvh2-qm8p-8f5vCGA-vx4g-5pmf-2px8CGA-vxjm-2pc3-qqq4CGA-w4fr-6r2x-49jqCGA-w95v-cgwx-p98pCGA-whcj-h7m2-27fmCGA-wvmf-jqhr-7jc7CGA-wwmf-jv62-rqhcCGA-wwxv-87gc-7f3fCGA-wxx2-q6w5-7j4wCGA-xg45-56pv-pq44
Published 06-01-2021Last modified 08-10-2026
Vulnerability summary
CVE-2020-36187 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 4.24% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
4.24%
0%100%
Low · -0.98 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 06-01-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
4.24%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
-0.98 pp
From 5.22% on 18-09-2026
18-09-202618-10-2026
EPSS score4.24%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cowtowncoder.medium.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle41 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_corporate_lending_process_management14.2 | 14.3 | 14.5
- banking_credit_facilities_process_management14.2 | 14.3 | 14.5
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Netapp2 products
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.0.0, < 2.9.10.8
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.8
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 116 products
References
17 links- cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCREPORTEVIDENCEWEBExploitTechnical DescriptionThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2997X Refsource MISCREPORTWEBIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
