CVE-2020-36518

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/FasterXML/jackson-databind/issues/2816Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00001.htmlExploit, Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00035.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220506-0004/Third Party Advisory
https://www.debian.org/security/2022/dsa-5283Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2816Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00001.htmlExploit, Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00035.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220506-0004/Third Party Advisory
https://www.debian.org/security/2022/dsa-5283Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory

Timeline

Published: Mar 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-365194.9Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse CVE-2020-36529.1Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length CVE-2020-365217.1An out-of-bounds read was addressed with improved input validation. This issue is fixed in iCloud for Windows 11.4, iOS 14.0 and iPadOS 14.0 CVE-2020-365235.4A vulnerability was found in PlantUML 6.43. It has been declared as problematic. Affected by this vulnerability is the component Database In CVE-2020-365245.4A vulnerability was found in Refined Toolkit. It has been rated as problematic. Affected by this issue is some unknown functionality of the CVE-2020-365255.4A vulnerability classified as problematic has been found in Linking. This affects an unknown part of the component New Windows Macro. The ma CVE-2020-365265.4A vulnerability classified as problematic was found in Countdown Timer. This vulnerability affects unknown code of the component Macro Handl CVE-2020-365275.4A vulnerability, which was classified as problematic, has been found in Server Status. This issue affects some unknown processing of the com CVE-2020-365286.5A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to br CVE-2020-365298.8A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.p CVE-2020-36539.1Possible buffer over-read in windows wlan driver function due to lack of check of length of variable received from userspace in Snapdragon C CVE-2020-365308.8A vulnerability classified as critical was found in SevOne Network Management System up to 5.7.2.22. This vulnerability affects the Alert Su