jackson-databind: Validator bypass via generic type arguments
Summary
The Jackson library jackson-databind checks only the outer class of a class-name type ID during polymorphic deserialization. Classes passed as generic or array element arguments are not validated, so an attacker who controls the JSON type information can instantiate classes that the configured validator would reject. The earlier fix for CVE-2026-54512 is incomplete. Under the default typing or class-name polymorphism paths, the bypass can lead to arbitrary class instantiation and, depending on classes on the classpath, remote code execution under the application account.
Affected
- com.fasterxml.jackson.core:jackson-databind 2.10.0 to < 2.18.12
- com.fasterxml.jackson.core:jackson-databind 2.19.0 to < 2.21.8
- com.fasterxml.jackson.core:jackson-databind 2.22.0 to < 2.22.4
- tools.jackson.core:jackson-databind 3.0.0 to < 3.1.8
- tools.jackson.core:jackson-databind 3.2.0 to < 3.2.4
- Releases before 2.10.0 are not affected.
- Versions 2.18.8, 2.21.4 and 3.1.4 (CVE-2026-54512 fixes) are still affected.
Fixed in
- com.fasterxml.jackson.core:jackson-databind 2.18.12
- com.fasterxml.jackson.core:jackson-databind 2.21.8 (also for the 2.19.x line)
- com.fasterxml.jackson.core:jackson-databind 2.22.4
- tools.jackson.core:jackson-databind 3.1.8
- tools.jackson.core:jackson-databind 3.2.4
- Vendor fixes for out-of-support releases: Unknown.
Workaround
- No vendor-approved configuration workaround is documented.
- Disable default typing and class-name polymorphism where they are not required.
- Review the use of @JsonTypeInfo and activateDefaultTyping in the code.
Exploitation
- No in-the-wild exploitation known at the time of writing. Not verified against the CISA KEV catalogue.
- The vendor advisory describes reproduced examples; public proof-of-concept details are available.
- EPSS: 1.2 % (percentile 68).
Our recommendation
- Inventory all jackson-databind versions, including transitive dependencies such as spring-boot-starter-json.
- Upgrade to the fixed releases listed above. Do not stop at the CVE-2026-54512 fix.
- If an upgrade is not possible, disable default typing and restrict polymorphic type handling.
- Check internet-facing services that accept JSON with type information and monitor them for suspicious deserialization requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Advisory GHSA-m8xf-2cr7-77ph (vendor) github.com
- GitHub Advisory GHSA-j3rv-43j4-c7qm (CVE-2026-54512) github.com
- CVE Record CVE-2026-54512 www.cve.org
- HeroDevs vulnerability directory www.herodevs.com
- Red Hat CVE page access.redhat.com
- VulDB CVE-2026-110879 vuldb.com
- OpenMetadata pull request (3.1.8 fix reference) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:23.
Original description (NVD)
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the type ID to _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing its corresponding declared generic binding. It also invokes validators with arguments that have not passed the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID. Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's base type is approved. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that expose that default typing. The default-validator case requires no application-authored validator: with @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as "Not a subtype", while a type ID naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied bean properties. Where class-name default typing permits Map, a property declared as Map<String,String> accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath and attacker-controlled XML the application can load, that constructor loads the XML and invokes ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in jackson-databind 2.10.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.