CVE-2020-9546 in Retail Sales Audit
Summary
by MITRE
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/05/2026
The vulnerability CVE-2020-9546 represents a critical deserialization flaw within the FasterXML jackson-databind library that affects versions prior to 2.9.10.4. This issue specifically targets the interaction between serialization gadgets and type handling mechanisms, creating a pathway for remote code execution through maliciously crafted data payloads. The vulnerability is particularly concerning because it leverages the HikariConfig class from the Apache Hadoop shaded package, which is commonly used in enterprise applications for database connection pooling. The flaw exists in the way jackson-databind processes type information during deserialization, allowing attackers to exploit this weakness when the library encounters serialized objects that contain malicious type metadata.
The technical implementation of this vulnerability stems from jackson-databind's handling of polymorphic typing and serialization gadgets. When the library processes serialized data containing type information, it fails to properly validate or sanitize the type metadata, particularly when dealing with classes from external libraries like the shaded HikariConfig. This creates a condition where an attacker can craft a serialized payload that includes malicious type information, which when deserialized by the vulnerable application, triggers the execution of arbitrary code on the target system. The vulnerability is classified under CWE-502 as Deserialization of Untrusted Data, which is a well-known attack vector in the cybersecurity landscape. The attack pattern follows the typical deserialization exploit methodology where malicious data is crafted to leverage existing code gadgets within the application's classpath, enabling remote code execution without requiring authentication.
The operational impact of CVE-2020-9546 is severe across numerous enterprise environments that utilize jackson-databind for data processing and API communication. Applications that deserialize user-provided data or process external inputs through jackson-databind are at risk, particularly web applications, microservices, and backend systems that handle serialized objects from untrusted sources. The vulnerability can be exploited through various attack vectors including HTTP requests, file uploads, or any mechanism that involves deserializing data from external sources. This aligns with ATT&CK technique T1203 - Exploitation for Client Execution, where attackers leverage application vulnerabilities to execute code on target systems. The impact extends beyond simple code execution as it can lead to complete system compromise, data exfiltration, and lateral movement within network environments. Organizations using affected versions of jackson-databind must consider this vulnerability as a high-priority threat requiring immediate remediation.
Mitigation strategies for CVE-2020-9546 focus primarily on updating to the patched version of jackson-databind 2.9.10.4 or later, which addresses the type handling and serialization gadget interaction issues. Organizations should also implement defensive measures such as disabling the use of polymorphic typing where possible, implementing strict input validation, and employing application firewalls to filter potentially malicious serialized data. The remediation approach should include comprehensive vulnerability scanning across all systems using jackson-databind, particularly those that process external data inputs. Additionally, organizations should consider implementing runtime protection mechanisms and monitoring for unusual deserialization activities that might indicate exploitation attempts. The vulnerability highlights the importance of keeping third-party libraries updated and maintaining proper security hygiene in software development practices, aligning with security frameworks that emphasize the need for secure coding practices and regular security assessments to prevent exploitation of known vulnerabilities.