VYPR
← All advisories
High severityNVD Advisory· Published Dec 17, 2020· Updated Aug 4, 2024

CVE-2020-35491

CVE-2020-35491

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

FasterXML jackson-databind before 2.9.10.8 mishandles interaction between serialization gadgets and typing via commons-dbcp2 SharedPoolDataSource.

Vulnerability

Overview

CVE-2020-35491 is a deserialization vulnerability in FasterXML jackson-databind versions 2.x prior to 2.9.10.8. The flaw arises from improper handling of the interaction between serialization gadgets and the Default Typing feature, specifically involving the org.apache.commons.dbcp2.datasources.SharedPoolDataSource class. This class acts as a gadget that can be leveraged during deserialization, allowing an attacker to execute arbitrary code if certain conditions are met [1][2].

Attack

Vector and Prerequisites

Exploitation requires that Jackson's default typing is enabled (e.g., via @JsonTypeInfo or ObjectMapper.enableDefaultTyping()) and that the classpath contains the vulnerable commons-dbcp2 library. An attacker can craft a malicious JSON payload that, when deserialized, triggers the gadget chain. The vulnerability is a type confusion issue where the SharedPoolDataSource class can be used to invoke dangerous operations, such as JNDI lookups, leading to remote code execution [3][4].

Impact

Successful exploitation allows an unauthenticated attacker to achieve remote code execution in the context of the application. This could lead to full system compromise, data exfiltration, or lateral movement within the network. The vulnerability is considered critical (CVSS base score 9.8) due to the low complexity, no authentication requirements, and potential for high impact on confidentiality, integrity, and availability [2].

Mitigation

The vulnerability is fixed in jackson-databind version 2.9.10.8, which adds the SharedPoolDataSource class to the blacklist of known gadget types [4]. Users should upgrade to this version or later. If upgrading is not immediately possible, disabling default typing or restricting the classpath to exclude commons-dbcp2 can mitigate the risk.

References
  1. GitHub - FasterXML/jackson-databind: General data-binding package for Jackson: works on streaming API (core) implementation(s)
  2. NVD - CVE-2020-35491
  3. Block 2 more gadget types (commons-dbcp2, CVE-2020-35490/CVE-2020-35491)
  4. Fixed #2986 · FasterXML/jackson-databind@41b8bdb

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.0.0, < 2.9.10.82.9.10.8

Affected products

1

Patches

1
41b8bdb5ccc1

Fixed #2986

https://github.com/FasterXML/jackson-databindTatu SalorantaDec 16, 2020via ghsa
commit
2 files changed · +9 −0
  • release-notes/VERSION-2.x+5 −0 modified
    @@ -4,6 +4,11 @@ Project: jackson-databind
 === Releases === 
 ------------------------------------------------------------------------
 
+2.9.10.8 (not yet released)
+
+#2986: Block two more gadget types
+ (reported by Al1ex@knownsec)
+
 2.9.10.7 (02-Dec-2020)
 
 #2589: `DOMDeserializer`: setExpandEntityReferences(false) may not prevent
  • src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java+4 −0 modified
    @@ -207,6 +207,10 @@ public class SubTypeValidator
         s.add("com.nqadmin.rowset.JdbcRowSetImpl");
         s.add("org.arrah.framework.rdbms.UpdatableJdbcRowsetImpl");
 
+        // [databind#2986]: dbcp2
+        s.add("org.apache.commons.dbcp2.datasources.PerUserPoolDataSource");
+        s.add("org.apache.commons.dbcp2.datasources.SharedPoolDataSource");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.