Act nowDisclosed

Advisory · CVE-2026-110879

jackson-databind validator bypass lets attackers hide forbidden classes inside generic type arguments

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, bypassing the fix for CVE-2026-54512 and allowing arbitrary class instantiation where polymorphic deserialization is exposed. CVSS 3.1 9.8.

Advisory published October 28, 2026Independent summary
Vendor
FasterXML
Product
jackson-databind
Identifier / CWE
CVE-2026-110879
CWE-502
Action timing
Immediate
ELI5

Explain it like I’m five

Jackson checks the name on the outside of a nested box but not the names tucked inside it. An attacker writes a harmless-looking wrapper on the outside and hides a dangerous class inside, and Jackson builds the dangerous object anyway.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Polymorphic JSON submitted

    An attacker who can supply JSON to an affected deserialization path sends a class-name type ID for a generic wrapper type.

  2. 02Outer class passes validation

    Jackson checks the outer class against the declared base type and the configured validator, and it passes.

  3. 03Generic argument slips through

    The class named inside the generic argument is validated against the wrong type, or not restricted by the validator at all, even though the same class is rejected as a direct type ID.

  4. 04Forbidden class is instantiated

    Jackson deserializes the attacker-selected class, including attacker-supplied bean properties, under the application account.

  5. 05Classpath decides the damage

    Per the advisory, with Spring on the classpath and attacker-controlled XML the application can load, a selected class constructor can reach ProcessBuilder and execute commands; stock JDK classes can create or truncate files or issue URL requests.

What happened

The FasterXML advisory GHSA-m8xf-2cr7-77ph, published in NVD on October 28, 2026, rates CVE-2026-110879 critical at CVSS 3.1 9.8 (CWE-502) and describes it as an incomplete fix for CVE-2026-54512. jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. The element type of a plain array type ID is likewise left unvalidated once the array base type is approved.

Per the advisory, affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in Jackson 2.x and 3.x, and integrations that expose that default typing, including Spring Data Redis and Spring Security legacy Jackson paths named in the advisory. The NVD record lists these affected ranges: 2.10.0 to before 2.18.12, 2.19.0 to before 2.21.8, and 2.22.0 to before 2.22.4 for the 2.x artifact, and 3.0.0 to before 3.1.8 and 3.2.0 to before 3.2.4 for the 3.x artifact. The advisory states the issue is fixed in jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8 and 3.2.4, where every class named in a type ID is validated as if it were a direct type ID. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in 2.10.0.

What to do

  1. Inventory Java services and libraries that depend on jackson-databind, including transitive dependencies, and note the version and whether polymorphic deserialization or default typing is enabled.
  2. Upgrade jackson-databind to 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4 or later, matching your release line, on every affected service.
  3. Until upgraded, disable class-name polymorphism for untrusted data where you can, and replace broad allow rules with narrow subtype rules for the types you actually deserialize.
  4. Audit which gadget-bearing libraries sit on each affected classpath, especially where Spring or other powerful classes are reachable from a deserialization endpoint.
  5. Review logs around polymorphic deserialization endpoints for type IDs naming generic wrappers, array types, or classes your application never legitimately receives.
  6. Verify the deployed databind version after upgrading, including shaded, repackaged and container-bundled copies.

Management note

Jackson sits underneath a large share of Java services, and this is a bypass of the fix for the last databind validator flaw, not a new corner case. Any service that fixed CVE-2026-54512 and stopped there is still exposed; the upgrade, not the earlier patch, is the closing action.