7.5

CVE-2020-36518: debian debian_linux Out-of-bounds Write

Modified
AliasesRHSA-2023:2312RHSA-2024:3061UBUNTU-CVE-2020-36518
Published 11-03-2022Last modified 27-08-2025

Vulnerability summary

CVE-2020-36518 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 4.86% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
4.86%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 13 · Related 5
DLA-3207-1DSA-5283-1MGASA-2024-0069RHSA-2022:4918RHSA-2022:4919RHSA-2022:6782

Timeline

  1. 11-03-2022
    PublishedVulnerability first disclosed.
  2. 27-08-2025
    Last modifiedVulnerability information updated.

Description

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

4.86%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.86% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (lists.debian.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard106 products
  • cassandra-reaper< 4.0.1-r1
  • eco-java-gradle-2.10All versions (No fix recorded)
  • eco-java-gradle-2.11All versions (No fix recorded)
  • eco-java-gradle-2.12All versions (No fix recorded)
  • eco-java-gradle-2.13All versions (No fix recorded)
Redhat37 products
  • apache-commons-collections< 0:3.2.2-10.module+el8.10.0+20993+d0f024b0
  • apache-commons-lang< 0:2.6-21.module+el8.10.0+20993+d0f024b0
  • apache-commons-net< 0:3.6-3.module+el8.10.0+20993+d0f024b0
  • bea-stax< 0:1.2.0-16.module+el8.10.0+20993+d0f024b0
  • bea-stax-api< 0:1.2.0-16.module+el8.10.0+20993+d0f024b0
Oracle29 products
Netapp5 products
Wolfi4 products
  • cassandra-reaper< 4.0.1-r1
  • management-api-for-apache-cassandra-5.0< 0.1.89-r0
  • management-api-for-apache-cassandra-5.0-compat< 0.1.89-r0
  • scala-3.8< 3.8.4-r1
Debian2 products
  • jackson-databind< 2.8.6-1+deb9u10 | < 2.13.2.2-1
  • debian_linuxEOL9.0 | 10.0 | 11.0
Com.fasterxml.jackson.core1 product
  • jackson-databind≥ 2.13.0, < 2.13.2.1 | < 2.12.6.1
Fasterxml1 product
Ubuntu1 product
  • jackson-databindAll versions (No fix recorded)

9 vendors · 186 products

References

35 links
Show all 35 references