# jackson-databind: PolymorphicTypeValidator bypass via generic type arguments allows arbitrary class instantiation (CVE-2026-110879) · pwn.watch

> A critical bypass in jackson-databind, the Java JSON library, lets an attacker who controls polymorphic JSON smuggle arbitrary classes in as generic type arguments or array element types, even when the same class is rejected as a direct type ID. It's an incomplete fix for CVE-2026-54512. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in Jackson 2.x and 3.x, Spring Security's legacy Jackson 2 module, and Spring Data Redis's RedisSerializer.json() and GenericJackson2JsonRedisSerializer(). The advisory demonstrates a Spring path that ends in ProcessBuilder.start() under the application account. Exploitability depends on the app's polymorphism configuration and classpath. Upgrade to jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. GitHub rates it critical (CVSS 9.8).

Page: https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879 · generated 2026-10-28T02:45:21.103Z

## Status
- Severity: critical · status: live · patch: patched
- Product: jackson-databind (FasterXML Jackson, Java)
- Started: 2026-10-20
- CVEs: CVE-2026-110879, CVE-2026-54512
- Affected: com.fasterxml.jackson.core:jackson-databind 2.10.0 - 2.18.11; com.fasterxml.jackson.core:jackson-databind 2.19.0 - 2.21.7; com.fasterxml.jackson.core:jackson-databind 2.22.0 - 2.22.3; tools.jackson.core:jackson-databind 3.0.0 - 3.1.7; tools.jackson.core:jackson-databind 3.2.0 - 3.2.3
- Fixed in: jackson-databind 2.18.12; jackson-databind 2.21.8; jackson-databind 2.22.4; jackson-databind 3.1.8; jackson-databind 3.2.4

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879/feed.xml
- JSON Feed: https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879.json
- This file: https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879/llms.txt

## Updates (newest first)
- 2026-10-20: FasterXML publishes GHSA-m8xf-2cr7-77ph (critical): generic type arguments and array element types in class-name type IDs bypass PolymorphicTypeValidator, an incomplete fix for CVE-2026-54512. Fixed in 2.18.12, 2.21.8, 2.22.4, 3.1.8 and 3.2.4. (https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph)

## Fix brief
# Security brief: jackson-databind: PolymorphicTypeValidator bypass via generic type arguments allows arbitrary class instantiation (CVE-2026-110879)

Source: https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879 · status: live · severity: critical · updated Oct 28, 2026, 02:25 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A critical bypass in jackson-databind, the Java JSON library, lets an attacker who controls polymorphic JSON smuggle arbitrary classes in as generic type arguments or array element types, even when the same class is rejected as a direct type ID. It's an incomplete fix for CVE-2026-54512. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in Jackson 2.x and 3.x, Spring Security's legacy Jackson 2 module, and Spring Data Redis's RedisSerializer.json() and GenericJackson2JsonRedisSerializer(). The advisory demonstrates a Spring path that ends in ProcessBuilder.start() under the application account. Exploitability depends on the app's polymorphism configuration and classpath. Upgrade to jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. GitHub rates it critical (CVSS 9.8).

Severity detail: CVSS 3 9.8 per the GitHub advisory; real-world exploitability depends on polymorphic typing being enabled for untrusted input and on gadget classes on the classpath

- Product: jackson-databind (FasterXML Jackson, Java)
- CVE / advisory ids: CVE-2026-110879, CVE-2026-54512

## Affected versions
- com.fasterxml.jackson.core:jackson-databind 2.10.0 - 2.18.11
- com.fasterxml.jackson.core:jackson-databind 2.19.0 - 2.21.7
- com.fasterxml.jackson.core:jackson-databind 2.22.0 - 2.22.3
- tools.jackson.core:jackson-databind 3.0.0 - 3.1.7
- tools.jackson.core:jackson-databind 3.2.0 - 3.2.3

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- jackson-databind 2.18.12
- jackson-databind 2.21.8
- jackson-databind 2.22.4
- jackson-databind 3.1.8
- jackson-databind 3.2.4

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
If a Java project depends on jackson-databind, bump it to 2.18.12, 2.21.8 or 2.22.4 (2.x) or 3.1.8 / 3.2.4 (3.x), usually via the jackson-bom. Check mvn dependency:tree or gradle dependencies for transitive copies (Spring Boot pulls it in). Priority: apps using default typing (activateDefaultTyping), @JsonTypeInfo(use = Id.CLASS / MINIMAL_CLASS), Spring Data Redis's RedisSerializer.json() or GenericJackson2JsonRedisSerializer, or Spring Security's legacy Jackson 2 module. If you can't upgrade, stop using class-name polymorphism for untrusted data and keep attackers from writing serialized cache or session values.

## Latest updates
- Oct 20, 2026: FasterXML publishes GHSA-m8xf-2cr7-77ph (critical): generic type arguments and array element types in class-name type IDs bypass PolymorphicTypeValidator, an incomplete fix for CVE-2026-54512. Fixed in 2.18.12, 2.21.8, 2.22.4, 3.1.8 and 3.2.4.

## Advisories
- [GHSA-m8xf-2cr7-77ph: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (CVE-2026-110879)](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph) (FasterXML/jackson-databind)
- [NVD: CVE-2026-110879 (CVSS 3.1 9.8 critical, CWE-502, from the CNA)](https://nvd.nist.gov/vuln/detail/CVE-2026-110879) (NVD)

---
Machine-readable: https://pwn.watch/i/jackson-databind-ptv-bypass-cve-2026-110879.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.