jackson-databind: PolymorphicTypeValidator bypass via generic type arguments allows arbitrary class instantiation (CVE-2026-110879) ยท updates https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879 A critical bypass in jackson-databind, the Java JSON library, lets an attacker who controls polymorphic JSON smuggle arbitrary classes in as generic type arguments or array element types, even when the same class is rejected as a direct type ID. It's an incomplete fix for CVE-2026-54512. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in Jackson 2.x and 3.x, Spring Security's legacy Jackson 2 module, and Spring Data Redis's RedisSerializer.json() and GenericJackson2JsonRedisSerializer(). The advisory demonstrates a Spring path that ends in ProcessBuilder.start() under the application account. Exploitability depends on the app's polymorphism configuration and classpath. Upgrade to jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. GitHub rates it critical (CVSS 9.8). en Tue, 20 Oct 2026 00:00:00 GMT jackson-databind: PolymorphicTypeValidator bypass via generic type arguments allows arbitrary class instantiation (CVE-2026-110879): FasterXML publishes GHSA-m8xf-2cr7-77ph (critical): generic type arguments and array element types in class-name type IDs bypass PolymorphicTypeValidator, an incomplete fix for CVE-2026-54512. Fixed in 2.18.12, 2.21.8, 2.22.4, 3.1.8 and 3.2.4. https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879 https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879#2026-10-20-ba3a47bb Tue, 20 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph">Source</a></p>