Fasterxml · Jackson-Databind · CVE-2026-83557
**Name of the Vulnerable Software and Affected Versions**
com.fasterxml.jackson.core:jackson-databind versions 2.11.0 through 2.18.9
com.fasterxml.jackson.core:jackson-databind versions 2.19.0 through 2.21.5
com.fasterxml.jackson.core:jackson-databind versions 2.22.0 through 2.22.1
tools.jackson.core:jackson-databind versions 3.0.0 through 3.1.5
tools.jackson.core:jackson-databind versions 3.2.0 through 3.2.1
**Description**
The `DefaultBaseTypeLimitingValidator` (the `PolymorphicTypeValidator` used automatically with `@JsonTypeInfo` when no custom validator is configured) fails to include `java.lang.Comparable` in its list of unsafe base types. Consequently, the `isSafeSubType()` function returns true for any class implementing `Comparable`. If an application uses `@JsonTypeInfo` with `Comparable` as the base type without a custom validator, it allows an attacker to instantiate nearly any class that implements `Comparable`. This can be used to create objects such as `java.io.File` with attacker-specified paths, potentially leading to path traversal if the application later invokes path-sensitive methods on the object. This issue does not affect global default typing via `activateDefaultTyping()` as that method requires an explicit validator.
**Recommendations**
Update com.fasterxml.jackson.core:jackson-databind versions 2.11.0 through 2.18.9 to 2.18.10.
Update com.fasterxml.jackson.core:jackson-databind versions 2.19.0 through 2.21.5 to 2.21.6.
Update com.fasterxml.jackson.core:jackson-databind versions 2.22.0 through 2.22.1 to 2.22.2.
Update tools.jackson.core:jackson-databind versions 3.0.0 through 3.1.5 to 3.1.6.
Update tools.jackson.core:jackson-databind versions 3.2.0 through 3.2.1 to 3.2.2.
As a temporary mitigation, configure a custom `PolymorphicTypeValidator` instead of relying on the default validator when using `@JsonTypeInfo`.