CVE-2026-83557
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
The DefaultBaseTypeLimitingValidator in jackson-databind, applied automatically when @JsonTypeInfo is used without a custom validator, omitted java.lang.Comparable from its list of unsafe base types. As a result, an application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type accepts type identifiers for essentially any class implementing Comparable, giving an attacker-controlled object instantiation primitive. A demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path.
Risk Assessment
An attacker can force instantiation of chosen classes, and in the demonstrated java.io.File case this becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone, but applications using @JsonTypeInfo with Comparable as a base type are at risk.
Recommendation
Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 depending on the affected branch. If upgrading is not possible, configure an explicit PolymorphicTypeValidator for @JsonTypeInfo-annotated properties and classes.
Other vulnerabilities in jackson-databind
See all- CVE-2026-68497High
A vulnerability in jackson-databind allows XML datatype deserializers (Duration, XMLGregorianCalendar) to pass raw JSON strings directly to BigInteger/BigDecimal constructors, which are quadratic in digit count. Because the digits are inside a string token rather than a number token, the StreamReadConstraints.maxNumberLength guard does not apply, enabling an attacker to cause excessive CPU consumption with a single request.
- CVE-2021-20190High
A flaw in jackson-databind before 2.9.10.7 mishandles the interaction between serialization gadgets and typing. The highest threat is to data confidentiality, integrity, and system availability.
- CVE-2026-19032Medium
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. This can allow selecting and driving an arbitrary registered FileSystemProvider during deserialization of untrusted JSON. Impact is limited if only JDK built-in providers are present, but can be more severe with third-party providers on the classpath.
- CVE-2026-77310Medium
jackson-databind, the general-purpose data-binding functionality and tree-model for Jackson Data Processor, prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, has a vulnerability in the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize(). It calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration.
- CVE-2026-59889Medium
In jackson-databind, the UnwrappedPropertyHandler.processUnwrapped() method replays buffered JSON for a @JsonUnwrapped property without a prop.visibleInView() guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view.
- CVE-2026-59888Medium
A vulnerability in jackson-databind allows bypassing @JsonIgnore in Java Records using PropertyNamingStrategy. Affected versions from 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 register the ignored field under its original name before applying the naming strategy, enabling the renamed JSON key to be assigned to the Record constructor parameter.
- CVE-2026-54515Medium
In jackson-databind from version 2.8.0 to 2.18.9, 2.21.5, and 3.1.4, a vulnerability exists where per-property @JsonIgnoreProperties exclusions are applied by removing ignored properties from BeanPropertyMap, but subsequent case-insensitivity processing (ACCEPT_CASE_INSENSITIVE_PROPERTIES) rebuilds the map from the original unfiltered source, restoring the removed properties. The ignored property becomes writable again.
- CVE-2026-54514Medium
Vulnerability in jackson-databind from version 2.0.0 to 2.18.8, 2.21.4, and 3.1.4 causes immediate DNS resolution for untrusted input during deserialization of InetSocketAddress. An attacker can force a DNS query to a chosen host before any application-level validation.
- CVE-2026-54513High
Jackson-databind from 2.10.0 to 2.18.8, 2.21.4, and 3.1.4 has a vulnerability in BasicPolymorphicTypeValidator where allowIfSubTypeIsArray() allows any array type without validating the element type. This bypasses the allowlist and allows deserialization of dangerous types like EvilType[].
- CVE-2023-35116Medium
Jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies.
Original NVD description (English source)
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.