CVE-2020-14060 in jackson-databind
Summary
by MITRE
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/05/2026
The vulnerability identified as CVE-2020-14060 affects the FasterXML jackson-databind library version 2.x prior to 2.9.10.5, representing a critical security flaw that exploits the interaction between serialization gadgets and type handling mechanisms. This issue specifically targets the oadd.org.apache.xalan.lib.sql.JNDIConnectionPool component within the apache/drill project, creating a dangerous pathway for remote code execution through deserialization attacks. The vulnerability stems from improper handling of type information during the serialization process, allowing attackers to manipulate object creation and execute arbitrary code on vulnerable systems. The flaw exists in the library's ability to process type metadata when deserializing objects, particularly when dealing with certain JNDI-based components that can be leveraged to establish remote connections and execute malicious payloads.
The technical exploitation of this vulnerability relies on the library's deserialization mechanism and its handling of type information within serialized data streams. When jackson-databind processes serialized objects, it attempts to infer and validate types based on available metadata, but in this case, the library fails to properly validate or sanitize the type information associated with the JNDIConnectionPool class. This creates an opportunity for attackers to craft malicious serialized payloads that contain type information pointing to the vulnerable JNDI component, enabling remote code execution through the deserialization process. The vulnerability is particularly dangerous because it can be triggered through standard deserialization workflows without requiring special privileges or complex attack vectors, making it highly exploitable in web applications and services that utilize the affected library.
The operational impact of CVE-2020-14060 extends across numerous enterprise applications and systems that depend on FasterXML jackson-databind for data serialization and deserialization tasks. Organizations using vulnerable versions of the library face significant risks including unauthorized access, data breaches, and complete system compromise when attackers exploit this vulnerability through web applications, APIs, or any service that accepts serialized input. The vulnerability affects a wide range of systems including web applications, backend services, and microservices architectures that utilize JSON processing capabilities. Security teams must urgently assess their environments for affected systems and implement immediate remediation measures, as the vulnerability can be exploited remotely without authentication, making it particularly dangerous in publicly accessible applications.
Mitigation strategies for CVE-2020-14060 primarily involve upgrading to jackson-databind version 2.9.10.5 or later, which includes patches addressing the type handling and serialization gadget interactions. Organizations should also implement additional security controls such as disabling deserialization of untrusted data, implementing proper input validation, and configuring security filters to prevent exploitation attempts. The vulnerability aligns with CWE-502, which describes deserialization of untrusted data, and can be mapped to ATT&CK technique T1203, involving exploitation of remote services through deserialization vulnerabilities. Security monitoring should focus on detecting unusual deserialization patterns and network connections to external systems, as these activities often precede successful exploitation attempts. Regular security assessments and dependency updates are essential to prevent similar vulnerabilities from affecting organizational infrastructure in the future.