CVE-2026-110879

Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.core:jackson-databind versions 2.10.0 and later tools.jackson.core:jackson-databind versions 3.0.0 and later

Description An issue exists where the software validates the outer class of a class-name type ID but fails to properly validate classes within its generic arguments. This occurs because the DatabindContext. resolveAndValidateGeneric() function checks the outer class against the declared base type but passes arguments to validateTypeParameter(), which validates them against the outer base type instead of their specific declared generic binding. Consequently, unrelated classes can be accepted inside a generic subtype or within plain array type IDs once the base type is approved. This can be exploited through annotation-based class-name polymorphism or configured default typing. For instance, if a property is declared as Map<String,String>, an attacker could provide a HashMap<FileSystemXmlApplicationContext,String>. If Spring is present on the classpath, this can lead to arbitrary command execution via ProcessBuilder.start() by loading attacker-controlled XML.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.