Incomplete Fix
Security incidents tagged Incomplete Fix. Newest first.
1 Incomplete Fix incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 8
- Longest quiet run: 8 days (Oct 21–Oct 28)
- Patched
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments allows arbitrary class instantiation (CVE-2026-110879)
A critical bypass in jackson-databind, the Java JSON library, lets an attacker who controls polymorphic JSON smuggle arbitrary classes in as generic type arguments or array element types, even when the same class is rejected as a direct type ID. It's an incomplete fix for CVE-2026-54512. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in Jackson 2.x and 3.x, Spring Security's legacy Jackson 2 module, and Spring Data Redis's RedisSerializer.json() and GenericJackson2JsonRedisSerializer(). The advisory demonstrates a Spring path that ends in ProcessBuilder.start() under the application account. Exploitability depends on the app's polymorphism configuration and classpath. Upgrade to jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. GitHub rates it critical (CVSS 9.8).
jackson-databind (FasterXML Jackson, Java)Since Oct 20, 2026
