CVE-2026-83557
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
The DefaultBaseTypeLimitingValidator in jackson-databind, applied automatically when @JsonTypeInfo is used without a custom validator, omitted java.lang.Comparable from its list of unsafe base types. As a result, an application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type accepts type identifiers for essentially any class implementing Comparable, giving an attacker-controlled object instantiation primitive. A demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path.
Risk Assessment
An attacker can force instantiation of chosen classes, and in the demonstrated java.io.File case this becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone, but applications using @JsonTypeInfo with Comparable as a base type are at risk.
Recommendation
Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 depending on the affected branch. If upgrading is not possible, configure an explicit PolymorphicTypeValidator for @JsonTypeInfo-annotated properties and classes.
Other vulnerabilities in jackson-databind
See all- CVE-2026-110879Critical
A vulnerability in jackson-databind allows bypassing generic-argument validation: only the outer class of a type ID is checked, while attacker-selected classes inside generic arguments are accepted. This enables deserialization of dangerous classes (e.g., HashMap<FileSystemXmlApplicationContext,String>) even with a validator enabled, potentially leading to remote code execution. Affects versions 2.10.0+ and 3.0.0+; it is an incomplete fix for CVE-2026-54512.
- CVE-2021-20190High
A flaw in jackson-databind before 2.9.10.7 mishandles the interaction between serialization gadgets and typing. The highest threat is to data confidentiality, integrity, and system availability.
- CVE-2020-11620High
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly). This may allow an attacker to perform dangerous operations during deserialization.
- CVE-2019-14893Critical
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
- CVE-2019-14892Critical
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, which would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
- CVE-2020-9547Critical
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
- CVE-2020-8840Critical
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. This may allow remote code execution.
- CVE-2019-20330Critical
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. This may allow an attacker to abuse polymorphic deserialization to perform dangerous operations.
- CVE-2019-17531Critical
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
- CVE-2019-17267Critical
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
Original NVD description (English source)
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS