jackson-databind: PolymorphicTypeValidator bypass via generic type arguments allows arbitrary class instantiation (CVE-2026-110879)
jackson-databind (FasterXML Jackson, Java)
A critical bypass in jackson-databind, the Java JSON library, lets an attacker who controls polymorphic JSON smuggle arbitrary classes in as generic type arguments or array element types, even when the same class is rejected as a direct type ID. It's an incomplete fix for CVE-2026-54512. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in Jackson 2.x and 3.x, Spring Security's legacy Jackson 2 module, and Spring Data Redis's RedisSerializer.json() and GenericJackson2JsonRedisSerializer(). The advisory demonstrates a Spring path that ends in ProcessBuilder.start() under the application account. Exploitability depends on the app's polymorphism configuration and classpath. Upgrade to jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. GitHub rates it critical (CVSS 9.8).
Why this severity: CVSS 3 9.8 per the GitHub advisory; real-world exploitability depends on polymorphic typing being enabled for untrusted input and on gadget classes on the classpath
- Started
- Oct 20, 2026
Affected
- com.fasterxml.jackson.core:jackson-databind 2.10.0 - 2.18.11
- com.fasterxml.jackson.core:jackson-databind 2.19.0 - 2.21.7
- com.fasterxml.jackson.core:jackson-databind 2.22.0 - 2.22.3
- tools.jackson.core:jackson-databind 3.0.0 - 3.1.7
- tools.jackson.core:jackson-databind 3.2.0 - 3.2.3
Fixed in
- jackson-databind 2.18.12
- jackson-databind 2.21.8
- jackson-databind 2.22.4
- jackson-databind 3.1.8
- jackson-databind 3.2.4
Timeline1
Advisories2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
