CVE-2020-11112 in jackson-databind
Summary
by MITRE
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/05/2026
The vulnerability CVE-2020-11112 represents a critical security flaw in the FasterXML jackson-databind library affecting versions prior to 2.9.10.4. This issue specifically targets the interaction between serialization gadgets and typing mechanisms within the JSON processing framework, creating a pathway for remote code execution attacks. The vulnerability stems from improper handling of deserialization processes when specific class dependencies are present in the object graph being processed.
The technical flaw manifests through the exploitation of serialization gadgets within the jackson-databind library, where the system fails to properly validate or sanitize input data during the deserialization phase. When the library encounters objects that reference classes from apache/commons-proxy, particularly the org.apache.commons.proxy.provider.remoting.RmiProvider class, it creates opportunities for attackers to construct malicious payload objects that can execute arbitrary code on the target system. This vulnerability operates at the core of object serialization and deserialization mechanisms, leveraging the library's type handling capabilities to bypass normal security boundaries.
The operational impact of this vulnerability is severe, as it enables remote code execution attacks that can be triggered through crafted JSON payloads sent to applications using vulnerable jackson-databind versions. Attackers can leverage this flaw to execute arbitrary commands on affected systems, potentially leading to complete system compromise, data exfiltration, or further lateral movement within network environments. The vulnerability affects any application that processes untrusted JSON input and uses the affected jackson-databind library versions, making it particularly dangerous in web applications, API endpoints, and services that handle user-provided data.
Mitigation strategies for CVE-2020-11112 primarily involve upgrading to jackson-databind version 2.9.10.4 or later, which includes patches addressing the serialization gadget interaction issues. Organizations should also implement comprehensive input validation and sanitization measures, disable unnecessary deserialization features, and consider implementing additional security layers such as application firewalls or runtime protection mechanisms. The vulnerability aligns with CWE-502, which describes "Deserialization of Untrusted Data," and maps to ATT&CK technique T1059.007 for command and script interpreter execution, highlighting the critical nature of this security flaw in modern application security landscapes.