CVE-2020-11113 in jackson-databind
Summary
by MITRE
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/05/2026
The vulnerability CVE-2020-11113 represents a critical deserialization flaw within the FasterXML jackson-databind library, affecting versions prior to 2.9.10.4. This issue stems from improper handling of serialization gadgets in conjunction with typing mechanisms, creating a pathway for remote code execution attacks. The vulnerability specifically involves the interaction between jackson-databind's serialization framework and the org.apache.openjpa.ee.WASRegistryManagedRuntime class from the Apache OpenJPA library, which serves as a key component in the exploitation chain.
The technical flaw manifests when jackson-databind processes serialized data containing malicious objects that trigger the instantiation of classes from the OpenJPA library. The library's type handling mechanism fails to properly validate or restrict the types that can be deserialized, allowing attackers to leverage existing serialization gadgets within the OpenJPA framework. This creates a dangerous scenario where an attacker can inject malicious serialized data that, upon deserialization, executes arbitrary code on the target system. The vulnerability operates through the Jackson's default typing feature that automatically infers and handles object types during deserialization, making it particularly insidious as it can be triggered by simply processing untrusted input.
The operational impact of this vulnerability is severe and far-reaching across numerous applications and systems that utilize jackson-databind for JSON processing. Attackers can exploit this weakness to execute arbitrary code remotely, potentially leading to complete system compromise, data exfiltration, or service disruption. The vulnerability affects web applications, APIs, and any system that accepts JSON input from untrusted sources and processes it through jackson-databind. Given the widespread adoption of this library across enterprise environments and cloud services, the potential attack surface is extensive, making this vulnerability particularly dangerous in production environments where applications may be processing user-supplied JSON data.
Mitigation strategies for CVE-2020-11113 primarily involve immediate patching of affected jackson-databind versions to 2.9.10.4 or later, which addresses the core deserialization flaw through improved type validation and restriction mechanisms. Organizations should also implement strict input validation and sanitization practices, particularly when processing JSON data from external sources. The use of Jackson's disableDefaultTyping() method or explicit type registration can help prevent the automatic type resolution that enables exploitation. Additionally, security configurations should restrict the use of potentially dangerous classes and implement proper network segmentation to limit the impact of successful exploitation attempts. This vulnerability aligns with CWE-502 which describes deserialization of untrusted data, and maps to ATT&CK technique T1203 for exploitation of remote services, emphasizing the need for comprehensive security controls including runtime monitoring and application firewalls to detect and prevent exploitation attempts.