CVE-2026-83557
published 2026-09-01CVE-2026-83557: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom…
PriorityP339medium5.6CVSS 3.1
AVNACHPRNUINSUCLILAL
EPSS
0.59%
46.1th percentile
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.
Affected
80 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | de-minimal-rhel8 | — | — |
| ansible-automation-platform-24 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel8 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| candlepinproject | candlepin | — | — |
| debian | ceph | — | — |
| debian | dogtag-pki | — | — |
| debian | puppetserver | — | — |
| devspaces | multicluster-redirector-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| devspaces | server-rhel9 | — | — |
| exploit-intelligence | agent-client-rhel9 | — | — |
| fasterxml | jackson-databind | — | — |
| fasterxml | jackson-databind | >= 2.11.0 < 2.18.10 | 2.18.10 |
| fasterxml | jackson-databind | >= 2.19.0 < 2.21.6 | 2.21.6 |
| fasterxml | jackson-databind | >= 2.22.0 < 2.22.2 | 2.22.2 |
| fasterxml | jackson-databind | >= 3.0.0 < 3.1.6 | 3.1.6 |
| fasterxml | jackson-databind | >= 3.2.0 < 3.2.2 | 3.2.2 |
| jboss-eap-7 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk8-openshift-rhel8 | — | — |
CVSS provenance
nvdv3.15.6MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vendor_redhat5.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation
vendor_redhat·2026-09-01·CVSS 5.6
CVE-2026-83557 [MEDIUM] CWE-1287 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation
com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its bas
VulDB
FasterXML jackson-databind up to 3.2.1 DefaultBaseTypeLimitingValidator isSafeSubType deserialization (WID-SEC-2026-3147)
vuldb·2026-09-03·CVSS 5.6
CVE-2026-83557 [MEDIUM] FasterXML jackson-databind up to 3.2.1 DefaultBaseTypeLimitingValidator isSafeSubType deserialization (WID-SEC-2026-3147)
A vulnerability classified as critical was found in FasterXML jackson-databind up to 2.18.9/2.21.5/2.22.1/3.1.5/3.2.1. This issue affects the function isSafeSubType of the component DefaultBaseTypeLimitingValidator. The manipulation results in deserialization.
This vulnerability was named CVE-2026-83557. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83557 jackson-bom: jackson-databind: Path traversal via incomplete type validation [fedora-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 jackson-bom: jackson-databind: Path traversal via incomplete type validation [fedora-all]
CVE-2026-83557 jackson-bom: jackson-databind: Path traversal via incomplete type validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classe
Bugzilla
CVE-2026-83557 jetty: jackson-databind: Path traversal via incomplete type validation [fedora-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 jetty: jackson-databind: Path traversal via incomplete type validation [fedora-all]
CVE-2026-83557 jetty: jackson-databind: Path traversal via incomplete type validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, com
Bugzilla
CVE-2026-83557 google-gson: jackson-databind: Path traversal via incomplete type validation [fedora-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 google-gson: jackson-databind: Path traversal via incomplete type validation [fedora-all]
CVE-2026-83557 google-gson: jackson-databind: Path traversal via incomplete type validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classe
Bugzilla
CVE-2026-83557 ceph: jackson-databind: Path traversal via incomplete type validation [fedora-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 ceph: jackson-databind: Path traversal via incomplete type validation [fedora-all]
CVE-2026-83557 ceph: jackson-databind: Path traversal via incomplete type validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comp
Bugzilla
CVE-2026-83557 log4j: jackson-databind: Path traversal via incomplete type validation [fedora-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 log4j: jackson-databind: Path traversal via incomplete type validation [fedora-all]
CVE-2026-83557 log4j: jackson-databind: Path traversal via incomplete type validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, com
Bugzilla
CVE-2026-83557 python-avro: jackson-databind: Path traversal via incomplete type validation [fedora-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 python-avro: jackson-databind: Path traversal via incomplete type validation [fedora-all]
CVE-2026-83557 python-avro: jackson-databind: Path traversal via incomplete type validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classe
Bugzilla
CVE-2026-83557 google-gson: jackson-databind: Path traversal via incomplete type validation [epel-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 google-gson: jackson-databind: Path traversal via incomplete type validation [epel-all]
CVE-2026-83557 google-gson: jackson-databind: Path traversal via incomplete type validation [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes,
Bugzilla
CVE-2026-83557 jackson-databind: jackson-databind: Path traversal via incomplete type validation [fedora-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 jackson-databind: jackson-databind: Path traversal via incomplete type validation [fedora-all]
CVE-2026-83557 jackson-databind: jackson-databind: Path traversal via incomplete type validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application c
Bugzilla
CVE-2026-83557 byte-buddy: jackson-databind: Path traversal via incomplete type validation [fedora-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 byte-buddy: jackson-databind: Path traversal via incomplete type validation [fedora-all]
CVE-2026-83557 byte-buddy: jackson-databind: Path traversal via incomplete type validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes
Bugzilla
CVE-2026-83557 dogtag-pki: jackson-databind: Path traversal via incomplete type validation [fedora-all]
bugzilla·2026-09-09·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 dogtag-pki: jackson-databind: Path traversal via incomplete type validation [fedora-all]
CVE-2026-83557 dogtag-pki: jackson-databind: Path traversal via incomplete type validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes
Bugzilla
CVE-2026-83557 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation
bugzilla·2026-09-01·CVSS 5.6
CVE-2026-83557 [MEDIUM] CVE-2026-83557 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation
CVE-2026-83557 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Compar
https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388fhttps://github.com/FasterXML/jackson-databind/issues/6156https://github.com/FasterXML/jackson-databind/pull/6155https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7jhttps://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j
2026-09-01
Published