VYPR
← All advisories
High severityNVD Advisory· Published Dec 3, 2020· Updated Aug 4, 2024

CVE-2020-25649

CVE-2020-25649

Description

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2020-25649 is an XML External Entity (XXE) vulnerability in FasterXML jackson-databind's DOMDeserializer due to insecure entity expansion, threatening data integrity.

Vulnerability

Description CVE-2020-25649 is an XML External Entity (XXE) vulnerability found in FasterXML Jackson Databind. The flaw arises because the DOMDeserializer did not properly secure entity expansion, allowing attackers to exploit XML external entities [1][3]. This issue is similar to CVE-2019-10172 [3].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted XML input to an application that uses the affected DOMDeserializer to deserialize XML data. The attacker does not need authentication if the application accepts untrusted XML input. The vulnerability can be triggered via the default parser factory used by DOMDeserializer [3][4].

Impact

The primary threat from this vulnerability is data integrity, as stated in the NVD description [1]. An attacker could potentially read sensitive data or cause denial of service by including external entities in the XML.

Mitigation

The issue has been fixed in Jackson Databind version 2.11.0 with commit 612f971, which adds additional XML parser features to disable DOCTYPE declarations and external entity loading [4]. Users are advised to update to the latest version. Some Red Hat products like Fuse and Camel K are not susceptible due to no use of the vulnerable deserialization path [3].

References
  1. NVD - CVE-2020-25649
  2. FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)
  3. Fix #2589 · FasterXML/jackson-databind@612f971

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.6.0, < 2.6.7.42.6.7.4
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.7.0.0, < 2.9.10.72.9.10.7
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.10.0.0, < 2.10.5.12.10.5.1

Affected products

66

Patches

2
3d932709abd0

Fix #2589 (#2901)

https://github.com/FasterXML/jackson-databindJonathan GallimoreOct 23, 2020via ghsa
commit
3 files changed · +17 −0
  • release-notes/CREDITS-2.x+5 −0 modified
    @@ -872,3 +872,8 @@ Kaki King (kingkk9279@g)
 Jon Anderson (Jon901@github)
   * Reported #2544: java.lang.NoClassDefFoundError Thrown for compact profile1
    (2.9.10.2)
+
+Bartosz Baranowski (baranowb@github)
+  * Reported #2589: `DOMDeserializer`: setExpandEntityReferences(false) may not prevent
+   external entity expansion in all cases
+ (2.9.10.7)
  • release-notes/VERSION-2.x+4 −0 modified
    @@ -6,6 +6,10 @@ Project: jackson-databind
 
 2.9.10.7 (not yet released)
 
+#2589: `DOMDeserializer`: setExpandEntityReferences(false) may not prevent
+  external entity expansion in all cases
+ (reported by Bartosz B)
+
 #2854: Block one more gadget type (javax.swing, CVE-2020-xxx)
  (reported by Yangkun(ICSL))
  • src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java+8 −0 modified
    @@ -39,6 +39,14 @@ public abstract class DOMDeserializer<T> extends FromStringDeserializer<T>
             // 14-Jul-2016, tatu: Not sure how or why, but during code coverage runs
             //   (via Cobertura) we get `java.lang.AbstractMethodError` so... ignore that too
         }
+
+        // [databind#2589] add two more settings just in case
+        try {
+            parserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        } catch (Throwable t) { } // as per previous one, nothing much to do
+        try {
+            parserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        } catch (Throwable t) { } // as per previous one, nothing much to do
         DEFAULT_PARSER_FACTORY = parserFactory;
     }
612f971b78c6

Fix #2589

https://github.com/FasterXML/jackson-databindTatu SalorantaJan 10, 2020via ghsa
commit
3 files changed · +16 −0
  • release-notes/CREDITS-2.x+5 −0 modified
    @@ -1051,3 +1051,8 @@ Joseph Koshakow (jkosh44@github)
 Haowei Wen (yushijinhun@github)
   * Reported #2565: Java 8 `Optional` not working with `@JsonUnwrapped` on unwrappable type
  (2.11.0)
+
+Bartosz Baranowski (baranowb@github)
+  * Reported #2589: `DOMDeserializer`: setExpandEntityReferences(false) may not prevent
+   external entity expansion in all cases
+ (2.11.0)
  • release-notes/VERSION-2.x+3 −0 modified
    @@ -34,6 +34,9 @@ Project: jackson-databind
  (reported by Haowei W)
 #2573: Add `MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES` to allow blocking
   use of unsafe base type for polymorphic deserialization
+#2589: `DOMDeserializer`: setExpandEntityReferences(false) may not prevent
+  external entity expansion in all cases
+ (reported by Bartosz B)
 - Add `SerializerProvider.findContentValueSerializer()` methods
 
 2.10.2 (05-Jan-2020)
  • src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java+8 −0 modified
    @@ -39,6 +39,14 @@ public abstract class DOMDeserializer<T> extends FromStringDeserializer<T>
             // 14-Jul-2016, tatu: Not sure how or why, but during code coverage runs
             //   (via Cobertura) we get `java.lang.AbstractMethodError` so... ignore that too
         }
+
+        // [databind#2589] add two more settings just in case
+        try {
+            parserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        } catch (Throwable t) { } // as per previous one, nothing much to do
+        try {
+            parserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        } catch (Throwable t) { } // as per previous one, nothing much to do
         DEFAULT_PARSER_FACTORY = parserFactory;
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

138

News mentions

0

No linked articles in our index yet.