CVE-2020-36188: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-36188DEBIAN-CVE-2020-36188CGA-22x9-3f69-vpj3CGA-29gw-94hx-vxp8CGA-29jh-3w4f-r9pjCGA-2f9x-r873-mx5wCGA-2vxv-53j7-5pjrCGA-32pp-438f-vm3xCGA-39m7-rfj6-r627CGA-3c5v-58ph-jcx9CGA-3f4v-jvg5-m5qjCGA-3gjm-5ppj-q88pCGA-3v92-4v62-85xpCGA-46c7-8ffp-jwpcCGA-49gq-5j6p-m8h7CGA-4pr3-r3v8-6jq2CGA-4rg5-g2pm-x333CGA-4rwg-87fg-fqjpCGA-4wx3-g5rm-fwx3CGA-52hw-wwmh-hrw6CGA-52v2-mfxf-w8mrCGA-5396-jq83-5gq7CGA-559m-5936-p349CGA-56f6-x8q3-pf9fCGA-578v-2x7j-mg35CGA-58hj-pj92-cgp4CGA-5932-5frx-7chcCGA-5987-37vf-j7j3CGA-5fmj-w2vf-q94vCGA-5hgp-p634-fhc2CGA-5qh9-mgqq-9m97CGA-63g9-2v59-pq7rCGA-6486-hf43-89p9CGA-68j2-hffh-3jgcCGA-6f4v-mwh5-9xq9CGA-6fjg-7qh3-7956CGA-6frm-qv97-5vcwCGA-6m27-gw4f-5w7qCGA-6q2g-7cr2-qmf5CGA-76jc-qxvq-6f89CGA-76rq-8q9q-6w3jCGA-79g7-xm6m-pvm5CGA-7fhm-j53j-fj4mCGA-7qxj-wmjg-vrx8CGA-7vmc-w33m-82hwCGA-7w85-chxq-h2xjCGA-8223-j2v7-792pCGA-88w3-ppc4-v67qCGA-8cg4-f47r-4c6fCGA-8j3v-jrjf-qvr5CGA-8vrh-47f5-g66rCGA-936x-845j-8p6cCGA-96m8-r45x-4r5xCGA-9fgq-83c8-95v8CGA-9j39-3j96-gr4wCGA-9pp7-6j65-vv9qCGA-9r38-v57m-7qg9CGA-9wf8-hwqh-g52pCGA-9x9c-554q-vmqhCGA-9xfh-xc7m-j8rcCGA-9xqq-5w29-59ccCGA-c2vm-86c7-4fcjCGA-c55h-8w9j-wjc9CGA-c7q6-q4gg-8ffxCGA-ccm4-xrgx-52ggCGA-ccqp-mh49-6524CGA-cf65-vprr-65xpCGA-cf8j-c65r-rwf6CGA-cg5r-q6xq-9q9fCGA-cvfv-44q9-67mvCGA-f3vg-qrfp-cfqmCGA-f49f-hmx2-xqwxCGA-f5fq-jg2g-64pwCGA-fhc6-8v89-v7jhCGA-fr9r-h2f9-w6vjCGA-fwv8-58f9-rgcrCGA-g28c-w8c3-w44cCGA-g2ch-fc9f-chf7CGA-g2gv-4f29-f2jgCGA-g3jw-8823-36qjCGA-g779-h4pc-v584CGA-gg58-j59v-7r2cCGA-ghj8-29wf-w4g2CGA-h4px-38hf-mmj5CGA-h4w6-56pq-r5fqCGA-h7q7-56c3-vx72CGA-h96r-wp6j-8hf2CGA-hpwq-34rv-7388CGA-hr78-23gw-9677CGA-hvr8-mpg6-269wCGA-j2pm-25mr-48rvCGA-j6gf-f5wf-g4mfCGA-j743-hrxh-hpcqCGA-j867-pfmp-jcwcCGA-jh35-r9m7-f5rjCGA-jjq5-fgfm-rr2fCGA-jr44-c2qv-q6xpCGA-jxph-jgh4-87hmCGA-m45r-j4g2-rrqcCGA-m47c-2rxw-xr96CGA-m8cf-m24r-875gCGA-m8p2-whg6-7f6mCGA-mh78-542r-9gxpCGA-mhwp-6524-545gCGA-mhwp-f297-pvjmCGA-mjgj-xgvc-36r5CGA-mq64-5x95-r65cCGA-mq79-m427-w3v5CGA-mv26-w387-4pmcCGA-p5m8-8575-gmvgCGA-p6q9-83gw-qxq4CGA-p7r4-5wmc-9rx4CGA-pc7q-w8r2-xr68CGA-pg53-q3c4-wjp3CGA-pm9v-2x22-3vw4CGA-pvfj-9pm6-4m9fGHSA-f9xh-2qgp-cq57CGA-q2v9-pcg6-xcp6CGA-q3wg-5v9h-5rh5CGA-q52q-m8r9-x9gpCGA-q6c3-528g-gj3mCGA-q93j-5w4f-r5wgCGA-q959-99mf-249vCGA-q95c-v5g9-qhgqCGA-q9x2-mhxm-r4jqCGA-qx29-2g4g-76mvCGA-r3p2-gcp5-8mj5CGA-r6v9-hh3h-7xqgCGA-r965-6hq9-g268CGA-r9j2-66r3-4h25CGA-rj4x-mrc7-cfqjCGA-rv4v-265j-xh59CGA-rv8c-p58c-5wrmCGA-v4fr-4rvr-6qwjCGA-v6f3-5wm7-255pCGA-v9hm-3xvg-g7hhCGA-vcfr-v2q4-p8m6CGA-vfcp-p9fj-v8wpCGA-vj9c-wwq2-9wmjCGA-vp5h-wpr4-j3jpCGA-vvfg-cwhr-wc72CGA-w2f2-w44x-rchrCGA-w7pf-3v7q-m9pgCGA-whr5-c6xg-xqfqCGA-wm2m-p393-vf7cCGA-wr8q-gf4h-4875CGA-wvpj-w9ff-4v73CGA-wwfx-qwjv-5mcqCGA-x43w-j48g-p7f6CGA-xcjm-5xg9-p25cCGA-xfc5-hf75-4w4pCGA-xrm5-wcvx-r277CGA-xxj8-q3r4-xmxc
Published 06-01-2021Last modified 08-10-2026
Vulnerability summary
CVE-2020-36188 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 8.79% chance of exploitation in the next 30 days, higher than 95.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
8.79%
0%100%
Low · -2.12 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 06-01-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
8.79%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
-2.12 pp
From 10.91% on 18-09-2026
18-09-202618-10-2026
EPSS score8.79%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cowtowncoder.medium.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle41 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_corporate_lending_process_management14.2 | 14.3 | 14.5
- banking_credit_facilities_process_management14.2 | 14.3 | 14.5
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Netapp2 products
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.7.0, < 2.9.10.8 | ≥ 2.0.0, < 2.6.7.5
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.8
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 116 products
References
17 links- cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCREPORTEVIDENCEWEBExploitTechnical DescriptionThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2996X Refsource MISCREPORTWEBIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
