Back to CVE records
High 7.5Published Dec 3, 2020
CVE-2020-25649A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.
Updated under an hour ago ()
Does this affect you?
It affects fasterxml jackson-databind and 38 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-611
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
fasterxml jackson-databind fasterxml:jackson-databind | from 2.6.0 before 2.6.7.4; from 2.9.0 before 2.9.10.7; from 2.10.0 before 2.10.5.1 | NVD |
netapp oncommand_api_services netapp:oncommand_api_services | all versions | NVD |
netapp oncommand_workflow_automation netapp:oncommand_workflow_automation | all versions | NVD |
netapp service_level_manager netapp:service_level_manager | all versions | NVD |
fedoraproject fedora fedoraproject:fedora | 32 | NVD |
quarkus quarkus quarkus:quarkus | through 1.6.1 | NVD |
apache iotdb apache:iotdb | before 0.12.0 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.6 | NVD |
oracle agile_product_lifecycle_management_integration_pack oracle:agile_product_lifecycle_management_integration_pack | 3.6 | NVD |
oracle banking_apis oracle:banking_apis | from 18.1 through 18.3; 19.1; 19.2; 20.1; 21.1 | NVD |
oracle banking_platform oracle:banking_platform | 2.6.2; 2.7.0; 2.7.1; 2.8.0; 2.9.0; 2.10.0 | NVD |
oracle banking_treasury_management oracle:banking_treasury_management | 4.4 | NVD |
oracle blockchain_platform oracle:blockchain_platform | before 21.1.2 | NVD |
oracle coherence oracle:coherence | 12.2.1.4.0; 14.1.1.0.0 | NVD |
oracle commerce_platform oracle:commerce_platform | from 11.3.0 through 11.3.2; 11.2.0 | NVD |
oracle communications_billing_and_revenue_management oracle:communications_billing_and_revenue_management | 7.5.0.23.0; 12.0.0.3.0 | NVD |
oracle communications_cloud_native_core_unified_data_repository oracle:communications_cloud_native_core_unified_data_repository | 1.4.0 | NVD |
oracle communications_convergent_charging_controller oracle:communications_convergent_charging_controller | 12.0.4.0.0 | NVD |
oracle communications_evolved_communications_application_server oracle:communications_evolved_communications_application_server | 7.1 | NVD |
oracle communications_instant_messaging_server oracle:communications_instant_messaging_server | 10.0.1.5.0 | NVD |
oracle communications_interactive_session_recorder oracle:communications_interactive_session_recorder | 6.3; 6.4 | NVD |
oracle communications_network_charging_and_control oracle:communications_network_charging_and_control | 12.0.4.0.0 | NVD |
oracle communications_offline_mediation_controller oracle:communications_offline_mediation_controller | 12.0.0.3 | NVD |
oracle communications_pricing_design_center oracle:communications_pricing_design_center | 12.0.0.4.0 | NVD |
oracle communications_services_gatekeeper oracle:communications_services_gatekeeper | 7.0 | NVD |
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management | 7.4.1 | NVD |
oracle goldengate_application_adapters oracle:goldengate_application_adapters | 19.1.0.0.0 | NVD |
oracle health_sciences_empirica_signal oracle:health_sciences_empirica_signal | 9.0; 9.1 | NVD |
oracle insurance_policy_administration oracle:insurance_policy_administration | from 11.1.0 through 11.3.0; 11.0.2 | NVD |
oracle insurance_rules_palette oracle:insurance_rules_palette | from 11.1.0 through 11.3.0; 11.0.2 | NVD |
oracle jd_edwards_enterpriseone_orchestrator oracle:jd_edwards_enterpriseone_orchestrator | before 9.2.5.3 | NVD |
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools | before 9.2.5.3 | NVD |
oracle primavera_gateway oracle:primavera_gateway | from 17.7 through 17.12; from 17.12.0 through 17.12.11; from 18.8.0 through 18.8.11; from 19.12.0 through 19.12.10; 20.12.0 | NVD |
oracle retail_service_backbone oracle:retail_service_backbone | 14.1.3.2; 15.0.3.1; 16.0.3 | NVD |
oracle retail_xstore_point_of_service oracle:retail_xstore_point_of_service | 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 | NVD |
oracle sd-wan_edge oracle:sd-wan_edge | 9.0 | NVD |
oracle utilities_framework oracle:utilities_framework | 4.3.0.5.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0 | NVD |
oracle webcenter_portal oracle:webcenter_portal | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle communications_messaging_server oracle:communications_messaging_server | 8.0.2; 8.1 | NVD |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1887664x-refsource-misc
- https://github.com/FasterXML/jackson-databind/issues/2589x-refsource-misc
- https://lists.apache.org/thread.html/ra1157e57a01d25e36b0dc17959ace758fc21ba36746de29ba1d8b130%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r2b6ddb3a4f4cd11d8f6305011e1b7438ba813511f2e3ab3180c7ffda%40%3Ccommits.druid.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r2882fc1f3032cd7be66e28787f04ec6f1874ac68d47e310e30ff7eb1%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/re96dc7a13e13e56190a5d80f9e5440a0d0c83aeec6467b562fbf2dca%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r1b7ed0c4b6c4301d4dfd6fdbc5581b0a789d3240cab55d766f33c6c6%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rd317f15a675d114dbf5b488d27eeb2467b4424356b16116eb18a652d%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rc15e90bbef196a5c6c01659e015249d6c9a73581ca9afb8aeecf00d2%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r63c87aab97155f3f3cbe11d030c4a184ea0de440ee714977db02e956%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rc959cdb57c4fe198316130ff4a5ecbf9d680e356032ff2e9f4f05d54%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/raf13235de6df1d47a717199e1ecd700dff3236632f5c9a1488d9845b%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r6b11eca1d646f45eb0d35d174e6b1e47cfae5295b92000856bfb6304%40%3Cusers.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r6b11eca1d646f45eb0d35d174e6b1e47cfae5295b92000856bfb6304%40%3Cdev.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r5f8a1608d758936bd6bbc5eed980777437b611537bf6fff40663fc71%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r78d53a0a269c18394daf5940105dc8c7f9a2399503c2e78be20abe7e%40%3Cjira.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r98bfe3b90ea9408f12c4b447edcb5638703d80bc782430aa0c210a54%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r90d1e97b0a743cf697d89a792a9b669909cc5a1692d1e0083a22e66c%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r900d4408c4189b376d1ec580ea7740ea6f8710dc2f0b7e9c9eeb5ae0%40%3Cdev.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r8937a7160717fe8b2221767163c4de4f65bc5466405cb1c5310f9080%40%3Cdev.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r8937a7160717fe8b2221767163c4de4f65bc5466405cb1c5310f9080%40%3Cusers.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rd6f6bf848c2d47fa4a85c27d011d948778b8f7e58ba495968435a0b3%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r6e3d4f7991542119a4ca6330271d7fbf7b9fb3abab24ada82ddf1ee4%40%3Cnotifications.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r0b8dc3acd4503e4ecb6fbd6ea7d95f59941168d8452ac0ab1d1d96bb%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r68d029ee74ab0f3b0569d0c05f5688cb45dd3abe96a6534735252805%40%3Cnotifications.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.