CVE-2026-83557 in jackson-databind
Summary
by MITRE • 09/01/2026
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability centers on a flaw in the default polymorphic type validation logic within the Jackson Databind library, specifically involving the DefaultBaseTypeLimitingValidator class. This validator is automatically applied when developers use the @JsonTypeInfo annotation without explicitly configuring a custom PolymorphicTypeValidator. The core issue lies in its design philosophy of allowing all base types except for a hardcoded list of known unsafe classes. While this approach simplifies configuration, it introduces significant risk if the exclusion list is incomplete or outdated relative to the breadth of Java's standard library interfaces.
The critical technical flaw is that java.lang.Comparable was omitted from the fixed set of denied polymorphic resolution base types. This omission is particularly dangerous because Comparable is implemented by a vast majority of classes in both the JDK and typical application codebases, similar in scope to java.io.Serializable which is correctly blocked due to its well-known deserialization risks. By leaving Comparable unblocked, the validator's isSafeSubType method returns true for essentially any class that implements this interface, regardless of whether it poses a security risk during polymorphic instantiation.
This configuration error results in an attacker-controlled object instantiation primitive when processing JSON input containing type identifiers. An application declaring a property or class with @JsonTypeInfo and using Comparable as the base type will accept deserialization requests for almost any compatible class. In demonstrated scenarios, attackers have successfully constructed instances of java.io.File pointing to arbitrary paths chosen by the adversary. Although this specific vector does not directly lead to remote code execution through deserialization alone, it creates a path-traversal-adjacent vulnerability if the application subsequently performs operations on these objects that are sensitive to file system paths or other resource locations controlled by the input data.
The impact is limited in scope compared to global default typing issues because the activateDefaultTyping method structurally requires an explicit PolymorphicTypeValidator argument, thereby bypassing this specific validator entirely and avoiding this particular flaw. However, for applications relying on automatic validation with @JsonTypeInfo, the risk remains substantial as it allows unauthorized object creation that can lead to data integrity violations or further exploitation depending on how the instantiated objects are used within the application logic.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-501 Trust Boundary Violation, as the system fails to properly validate the type hierarchy before instantiation based on untrusted input. From an ATT&CK perspective, it relates to Tactic TA0043 Indirect Command Execution or potentially TA0008 Lateral Movement if file manipulation leads to unauthorized access controls being bypassed via path traversal techniques.
To mitigate this risk, users must upgrade their Jackson Databind dependencies immediately. The fix is available in versions 2.18.10, 2.21.6, 2.22.2 for the com.fasterxml.jackson.core artifact line, and versions 3.1.6 and 3.2.2 for the tools.jackson.core artifact line. Upgrading ensures that Comparable is correctly added to the list of unsafe base types, thereby restoring the intended security boundary for polymorphic deserialization operations using this validator.