Omkhar

**Name of the Vulnerable Software and Affected Versions** jackson-databind versions 2.10.0 through 2.18.7 jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.1.0 through 3.1.3 **Description** An issue exists in the `PolymorphicTypeValidator` (PTV), the primary safety mechanism for polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (indicated by the `<` character), the function `DatabindContext. resolveAndValidateGeneric()` only validates the raw container class name against the configured PTV. If the container is approved, the full canonical type string is parsed via `TypeFactory.constructFromCanonical()` and returned without validating the nested type arguments. This allows an attacker to bypass an allow-list by placing a denied class as a generic type parameter of an allowed container, such as `java.util.ArrayList<com.evil.Gadget>`. The denied class is then loaded via `Class.forName(name, true, loader)`, instantiated, and populated with attacker-controlled JSON properties. This can lead to arbitrary class instantiation and potential unauthenticated remote code execution if classes with exploitable side effects are present on the classpath. **Recommendations** Update to version 2.18.8. Update to version 2.21.4. Update to version 3.1.4.

**Name of the Vulnerable Software and Affected Versions** jackson-databind versions 2.10.0 through 2.18.7 jackson-databind versions 2.19.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3 **Description** The `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` function allowlists any array type based solely on `clazz.isArray()`, failing to validate the array's component type against the configured allowlist. This allows an attacker who controls JSON input to instantiate non-allowlisted types via an array wrapper, bypassing the protections intended by the Polymorphic Type Validator (PTV) and re-introducing the risk of gadget instantiation. This occurs because when Jackson deserializes elements without per-element type IDs, it instantiates the component type directly without further PTV checks. **Recommendations** Update to version 2.18.8 Update to version 2.21.4 Update to version 3.1.4

**Name of the Vulnerable Software and Affected Versions** jackson-databind versions 2.0.0 through 2.18.7 jackson-databind versions 2.19.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3 **Description** The `JDKFromStringDeserializer` function constructs `InetSocketAddress` using `new InetSocketAddress(host, port)`, which triggers eager DNS name resolution for hostname inputs during deserialization. When an application binds untrusted JSON into a type containing an `InetSocketAddress` field, it issues an attacker-chosen DNS query during the `readValue` process, occurring before any application-level validation or connection logic. This can lead to Server-Side Request Forgery (SSRF), where an attacker forces outbound DNS lookups for chosen hostnames to perform out-of-band interaction or internal-resolver probing. **Recommendations** Update to version 2.18.8 for versions in the 2.18 line. Update to version 2.21.4 for versions in the 2.19 through 2.21 line. Update to version 3.1.4 for versions in the 3.x line.

**Name of the Vulnerable Software and Affected Versions** jackson-databind versions 2.8.0 through 2.18.8 jackson-databind versions 2.21.0 through 2.21.4 jackson-databind versions 3.0.0 through 3.1.3 **Description** In the `createContextual()` function of `BeanDeserializerBase`, per-property `@JsonIgnoreProperties` exclusions are applied by ` handleByNameInclusion()`, which creates a contextual deserializer with ignored properties removed from its `BeanPropertyMap`. However, when the per-property case-insensitivity block is triggered by `@JsonFormat(ACCEPT CASE INSENSITIVE PROPERTIES)`, it rebuilds using the original unfiltered `this. beanProperties` map instead of the filtered `contextual. beanProperties`. This process overwrites the filtered map and restores the ignored properties, making them writable again. This can lead to a mass-assignment-style write where fields intended to be unwritable can be set using untrusted JSON if case-insensitive matching is enabled. **Recommendations** Update to version 2.18.9 Update to version 2.21.5 Update to version 3.1.4

**Name of the Vulnerable Software and Affected Versions** jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3 **Description** An issue exists in the `POJOPropertiesCollector. renameProperties()` function where a property with `@JsonProperty("renamed")` on the getter and `@JsonIgnore` on the setter is renamed instead of dropped. When `MapperFeature.INFER PROPERTY MUTATORS` is enabled, the private backing field is retained. During deserialization, `BeanDeserializerFactory.addBeanProps()` identifies that `hasField()` is true, creates a `FieldProperty`, and makes the backing field writable. This allows an attacker to provide a renamed JSON key to write to the backing field directly, bypassing the `@JsonIgnore` restriction on the setter, leading to property tampering or mass assignment. **Recommendations** Update to version 2.21.4 for the 2.21 line. Update to version 3.1.4 for the 3.x line.

**Name of the Vulnerable Software and Affected Versions** jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3 **Description** In the `BeanDeserializer. deserializeUsingPropertyBased()` function, the active-view (`@JsonView`) filter was applied only to creator properties, while the regular property-buffering branch lacked a `prop.visibleInView(activeView)` check. Due to a change where `SetterlessProperty.isMerging()` returns `true`, setterless Collection or Map properties are routed through this unguarded path. This allows setterless collections annotated with a restricted `@JsonView` to be populated from untrusted JSON even when the active view excludes them, resulting in an access-control or mass-assignment bypass where view-restricted properties can be written. **Recommendations** Update to version 2.21.4 Update to version 3.1.4

**Name of the Vulnerable Software and Affected Versions** jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3 **Description** The `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` function replays buffered JSON into creator parameters without consulting `prop.visibleInView(activeView)`. While the standard property-based creator path restricts creator properties based on the active view, this specific unwrapped-creator replay path bypasses that check. Consequently, a constructor parameter annotated with both `@JsonView(AdminView.class)` and `@JsonUnwrapped` can be populated from untrusted JSON input even when a more restrictive view is active, potentially bypassing write-side authorization boundaries. **Recommendations** Update to version 2.21.4 for the 2.21 line. Update to version 3.1.4 for the 3.x line.