CVE-2020-36518
Aliases:GHSA-57j2-w4cx-62h2RHSA-2023:2312RHSA-2024:3061DEBIAN-CVE-2020-36518CGA-3grx-4vj8-24f9CGA-49rq-wp7f-3mrqCGA-4vq5-h2h6-fcp4CGA-5hjg-m9hr-4rc3CGA-6m59-x6q8-m9p2CGA-h42q-cmr4-hh94CGA-p7p2-pcp2-v5v9CGA-2554-g5h9-hm79CGA-25vv-qx38-883rCGA-29jx-ff38-5cqrCGA-2j22-2v3m-6p86CGA-2xhp-jhmg-55q9CGA-36xg-cwv6-5wcqCGA-3j5f-qc3m-h9xfCGA-3pf9-x88g-5x2hCGA-3rx6-qvvm-v3vhCGA-4vgh-8mw4-828fCGA-4xxp-fp3w-3wx9CGA-52vx-jp62-v2gvCGA-5c7v-ffx5-93v3CGA-5w7h-h4j4-jgm4CGA-5xfm-8538-9x2qCGA-67cv-h329-fwj7CGA-6928-mfj7-84g3CGA-6m9f-8wgj-5f85CGA-6qv4-833v-gqh8CGA-6rjg-cxv4-6957CGA-6xwj-w67v-hg59CGA-7q4f-xxv5-8vm9CGA-8f5v-3f7v-wj7jCGA-8qg3-33h6-cprpCGA-97j9-g6fc-qh3qCGA-99xm-mg2g-q54cCGA-c9w3-43r7-mqpgCGA-cg8j-xcp5-rhm8CGA-cqc6-f5hm-24prCGA-cr9f-cfx3-jx4pCGA-crw5-3gg4-r95cCGA-f3rr-9p7p-c8gqCGA-fgcc-q5qc-42pjCGA-fgh5-7h92-cjw2CGA-fjxp-8wmg-p9hcCGA-fr79-c472-ffgqCGA-g27w-85gw-jmf6CGA-g864-j825-vm9rCGA-gchj-pr65-f44xCGA-gcx8-h75p-rpr5CGA-gh3v-74xq-v2g7CGA-h62p-mg97-hw8hCGA-hf5q-mg2g-4w84CGA-j39c-7987-m43xCGA-jcp7-2fg2-9j4qCGA-jcrh-c5px-7w3xCGA-m98x-85fv-4w2wCGA-mq7v-gvhv-5hf4CGA-p455-mcpq-4jw4CGA-p4gf-99pc-mcjjCGA-pc9h-48g9-rvr5CGA-pcqj-25h9-vjv3CGA-pmw5-55cc-rgxrCGA-pv3c-q7wx-q42pCGA-px37-rpmx-v74jCGA-qg83-xm8c-p6rfCGA-r62m-g477-8pvcCGA-r7v9-2hjm-rqg9CGA-r947-r82h-vrxpCGA-rgg2-v96p-xvf2CGA-rhx2-j3jv-5926CGA-v2h6-pj72-pxwmCGA-v429-wxhm-j97rCGA-v58m-j9hc-p4m2CGA-v6j9-97hp-f963CGA-v7v7-r3pq-2rvwCGA-vg44-v33v-v8vcCGA-vmfw-8j23-w75wCGA-vqvg-4x8f-682wCGA-vwc3-6629-6p52CGA-w29j-4jwc-h78cCGA-w3w3-w5r2-v56pCGA-w4w5-3ggf-rw89CGA-wcx8-mcxm-j8f2CGA-wf6v-337f-3wmpCGA-wrhp-5j9f-pccjCGA-x3vx-5p6r-jq4qCGA-xgxr-5f7f-h2g5CGA-xhm5-mpm8-cw33CGA-xj9h-r9v6-r3ccCGA-xpq7-944c-7q98CGA-276r-7xh2-q2qhCGA-3h37-w9c7-m4qhCGA-46q3-jhpf-9q7hCGA-4g2q-r3gq-h793CGA-4vgm-r82c-p6mvCGA-56xc-28cv-hhvjCGA-5865-5qp2-9x97CGA-5rph-qp58-h9cvCGA-5xcm-w38c-jr26CGA-645p-xqm6-g3p6CGA-6648-wcwq-xpvmCGA-85w2-4x8g-9hwgCGA-93mw-8xwp-746xCGA-98r2-hhv3-jg85CGA-9c45-6rf7-mj32CGA-9w5g-6f56-32pgCGA-cpvm-h666-6664CGA-f9jv-jcjc-q6pcCGA-ffqf-3jjx-344qCGA-fp2x-ccqg-xvpqCGA-fvmv-8989-2rc3CGA-fwrw-cgr6-x7m7CGA-hc22-939v-pj3hCGA-hx3x-8x8h-h399CGA-jfmx-pj3g-r99qCGA-jxx3-xwm4-c4h7CGA-m662-jr23-rvpqCGA-mh5p-7h6w-h56xCGA-pcw8-m7vp-c9hhCGA-prgg-745h-3ghvCGA-pwpv-jfhw-fmvjCGA-q223-649r-p37cCGA-q4f4-9vf5-qj49CGA-rj3x-7vmv-fccmCGA-rq9v-cmcx-7gc6CGA-w646-93q3-r67xCGA-w9wh-jr42-g52mCGA-wcr9-gqwf-fcrpCGA-x4m5-fhvq-49gmCGA-x9v9-rwgq-444wCGA-xq4j-gqj7-2w89CGA-28qq-pghh-7r3jCGA-2x45-3g7p-hv33CGA-35jj-fm8h-fpxmCGA-37m9-cr89-q9ccCGA-3p5g-w66p-qgg4CGA-424j-5g7c-47mrCGA-5x57-fc39-qw4vCGA-655g-48jm-c5g7CGA-6jrv-7f7v-9h63CGA-76cg-mjf2-6fmqCGA-94xq-5hhq-2j84CGA-96m6-35c4-p3x2CGA-9722-3m39-pg56CGA-9crr-8j2q-9cf5CGA-9prq-5x2w-662mCGA-9vwq-274r-rh2jCGA-c8rg-787q-mvhxCGA-c99v-63cw-r899CGA-cjcc-w6gh-34m9CGA-cq46-792m-xwfxCGA-cw95-ghg2-rvfcCGA-cwv3-95q9-qjcwCGA-f3p2-jfrp-f528CGA-fj32-grr9-w9qgCGA-fvqq-xwcf-8q38CGA-g442-78h8-g833CGA-g8hp-67ch-jvrgCGA-h84r-mh9p-288gCGA-h9jw-2jfq-hp5vCGA-hcx8-rmfm-52gcCGA-hp25-528x-7hr4CGA-jvc5-rq5w-5m2mCGA-jvf3-r8mj-82qjCGA-m3ch-px2j-9vqrCGA-mc5x-5hmh-46r7CGA-q33x-6v4p-6mvxCGA-qfq7-3r84-4jg2CGA-qgph-hf78-6cp9CGA-qr54-7hm8-wgcfCGA-r4m9-3p25-gwc5CGA-rc6f-7rgv-vfxgCGA-rf8m-wcj7-hw9hCGA-rfcw-f4rw-pj2jCGA-rp43-283g-6xq2CGA-v338-jw9m-ffwxCGA-v3fq-5wgj-7grrCGA-v46r-39wc-8v45CGA-v4pm-c465-7xqpCGA-v9x7-xch2-6vrrCGA-vj74-96j2-qjw9CGA-w223-6xc6-68cjCGA-w4h3-4725-pgc5CGA-wcvh-7mr3-87pcCGA-x359-468v-9c2jCGA-x7m5-36q4-783vCGA-x7w5-rv3r-rr55CGA-x89p-6qw2-c2x9CGA-xf9w-8h5x-p4x7CGA-xj7m-frv9-wpv2CGA-xjhh-gfr5-x62mCGA-xp7g-fvvr-rvhgCGA-xvp5-94h7-282cCGA-26r7-rwq5-7fhwCGA-2pf2-j8f7-4j22CGA-3g6h-6ccq-8325CGA-4qh7-x5f3-7jqgCGA-4w32-937h-8cmhCGA-547p-fgq9-ccr2CGA-5j84-v8c5-j6gfCGA-639r-cxm5-f46rCGA-63p3-4vhg-gp69CGA-672m-3chh-vh6fCGA-6qpc-gq59-55hcCGA-6x5v-jgj4-2344CGA-726w-f725-fvxrCGA-875j-8rm5-p3h2CGA-8h3v-56c7-g934CGA-8mq9-pgj8-438gCGA-8v22-xp94-3p74CGA-95w2-4vxj-362xCGA-c5wr-5x6h-h8mhCGA-cf36-fj6v-fv4hCGA-cjj3-24v2-j99vCGA-cqwx-wcfx-mx85CGA-cw8g-9hxp-3qp3CGA-f49j-jvh6-xx53CGA-fxxm-484m-cc3vCGA-g7vp-rgfr-8ch4CGA-gmh4-528j-v5cxCGA-gx63-33x2-hcmgCGA-h9jf-v6gc-wr9vCGA-hjp2-p82m-6w8vCGA-hpw8-6367-rfr7CGA-hwpr-4qcm-8h84CGA-mrhc-c3f9-x2cqCGA-mv9c-vxgh-3v74CGA-pf44-339g-r37rCGA-q36w-cpxq-7c96CGA-r3cm-3w59-gj28CGA-rgg4-2jv7-7pg7CGA-rhmm-3mrq-49qgCGA-rmv3-xwx7-2985CGA-rx3m-j638-q96pCGA-v9wh-mrqj-q54mCGA-vj7w-67vf-mfhcCGA-vmhc-jwr9-4p2pCGA-vxrm-fmr3-j5v2CGA-whq9-xp23-vr4gCGA-wqpp-v25c-2xm7CGA-x233-97cp-f3jqCGA-x8rp-fxmq-5rfcCGA-xcrm-69f4-vhj2CGA-xm44-pm2f-r7vx
Advisory lineage Upstream: 0 Downstream: 18
Modified
Published: 11 Mar 2022, 00:00
Last modified:27 Aug 2025, 20:34
Vulnerability Summary
Overall Risk (default)
medium
41/100 CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
4.86% LOW
5% probability +4.35%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
11 Mar 2022, 00:00
Published
Vulnerability first disclosed
27 Aug 2025, 20:34
Last Modified
Vulnerability information updated
Description
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS Trends
Current EPSS score: 4.86%• Percentile: 92%
Techniques & Countermeasures
- CWE-787•Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Affected Systems
- chainguard•cassandra-reaper
< 4.0.1-r1
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
- chainguard•eco-java-gradle-4.5
all
- chainguard•eco-java-gradle-4.5.1
all
- chainguard•eco-java-gradle-4.6
all
- chainguard•eco-java-gradle-4.7
all
- chainguard•eco-java-gradle-4.8
all
- chainguard•eco-java-gradle-4.8.1
all
- chainguard•eco-java-gradle-4.9
all
- chainguard•eco-java-gradle-5.0
all
- chainguard•eco-java-gradle-5.1
all
- chainguard•eco-java-gradle-5.1.1
all
- chainguard•eco-java-gradle-5.2
all
- chainguard•eco-java-gradle-5.2.1
all
- chainguard•eco-java-gradle-5.3
all
- chainguard•eco-java-gradle-5.3.1
all
Showing first 50 affected entries in server-rendered view.
References (34)
- https://github.com/FasterXML/jackson-databind/issues/2816
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20220506-0004/
- https://www.debian.org/security/2022/dsa-5283
- https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-36518
- https://github.com/FasterXML/jackson-databind/commit/0a8157c6ca478b1bc7be4ba7dccdb3863275f0de
- https://github.com/FasterXML/jackson-databind/commit/3cc52f82ecf943e06c1d7c3b078e405fb3923d2b
- https://github.com/FasterXML/jackson-databind/commit/8238ab41d0350fb915797c89d46777b4496b74fd
- https://github.com/FasterXML/jackson-databind/commit/b3587924ee5d8695942f364d0d404d48d0ea6126
- https://github.com/FasterXML/jackson-databind/commit/fcfc4998ec23f0b1f7f8a9521c2b317b6c25892b
- https://github.com/FasterXML/jackson-databind
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.12
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13
- https://security.netapp.com/advisory/ntap-20220506-0004
- https://access.redhat.com/errata/RHSA-2023:2312
- https://access.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
- https://bugzilla.redhat.com/show_bug.cgi?id=2064698
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2312.json
- https://access.redhat.com/security/cve/CVE-2020-36518
- https://www.cve.org/CVERecord?id=CVE-2020-36518
- https://github.com/advisories/GHSA-57j2-w4cx-62h2
- https://access.redhat.com/errata/RHSA-2024:3061
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index
- https://issues.redhat.com/browse/RHEL-12764
- https://issues.redhat.com/browse/RHEL-12765
- https://issues.redhat.com/browse/RHEL-16724
- https://issues.redhat.com/browse/RHEL-19140
- https://issues.redhat.com/browse/RHEL-22445
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3061.json
- https://security-tracker.debian.org/tracker/CVE-2020-36518