Bypassing PolymorphicTypeValidator in jackson-databind

Attack Techniques & MethodsYesterday, 07:16
Vulnerability CVE-2026-110879 is an incomplete fix for the previous issue CVE-2026-54512 in the jackson-databind library. The attack exploits a logical error in type validation: the validator checks the outer class but fails to validate classes specified in its generic type arguments or as array element types. As a result, an attacker can instantiate an arbitrary class that would have been rejected if specified directly.
How it works
  1. Entry point: The vulnerability can be triggered when an application deserializes JSON into objects based on class names — either through the @JsonTypeInfo(use = Id.CLASS) annotation or when default typing is enabled.
  2. Bug in the code: The DatabindContext._resolveAndValidateGeneric() method checks the outer class against the declared base type and then passes the arguments from the class-name type ID to _validateTypeParameter(). This method validates each argument against the outer base type instead of enforcing its corresponding declared generic type.
  3. Bypassing the validator: As a result, a dangerous class can be passed «under the guise» of another type, bypassing the validator's checks. If the allowIfBaseType(...) rule approves the outer type, Jackson replaces the configured validator with LaissezFaireSubTypeValidator, which allows all subtypes.
Article: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph/
Vulnerabilities
Researchers
Vendors
Products