CVE-2026-83557

Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.core:jackson-databind versions 2.11.0 through 2.18.9 com.fasterxml.jackson.core:jackson-databind versions 2.19.0 through 2.21.5 com.fasterxml.jackson.core:jackson-databind versions 2.22.0 through 2.22.1 tools.jackson.core:jackson-databind versions 3.0.0 through 3.1.5 tools.jackson.core:jackson-databind versions 3.2.0 through 3.2.1

Description The DefaultBaseTypeLimitingValidator (the PolymorphicTypeValidator used automatically with @JsonTypeInfo when no custom validator is configured) fails to include java.lang.Comparable in its list of unsafe base types. Consequently, the isSafeSubType() function returns true for any class implementing Comparable. If an application uses @JsonTypeInfo with Comparable as the base type without a custom validator, it allows an attacker to instantiate nearly any class that implements Comparable. This can be used to create objects such as java.io.File with attacker-specified paths, potentially leading to path traversal if the application later invokes path-sensitive methods on the object. This issue does not affect global default typing via activateDefaultTyping() as that method requires an explicit validator.

Recommendations Update com.fasterxml.jackson.core:jackson-databind versions 2.11.0 through 2.18.9 to 2.18.10. Update com.fasterxml.jackson.core:jackson-databind versions 2.19.0 through 2.21.5 to 2.21.6. Update com.fasterxml.jackson.core:jackson-databind versions 2.22.0 through 2.22.1 to 2.22.2. Update tools.jackson.core:jackson-databind versions 3.0.0 through 3.1.5 to 3.1.6. Update tools.jackson.core:jackson-databind versions 3.2.0 through 3.2.1 to 3.2.2. As a temporary mitigation, configure a custom PolymorphicTypeValidator instead of relying on the default validator when using @JsonTypeInfo.