Jackson Databind Vulnerability Affects Generic Arguments in Object Mapping

CVE-2026-110879

What is CVE-2026-110879?

A vulnerability within jackson-databind allows attackers to bypass generic argument validation, leading to potential remote code execution. The issue arises because the library accepts attacker-controlled types in certain contexts, despite violating type rules established in previous versions. The vulnerability impacts configurations using annotation-based class-name polymorphism and default typing. By exploiting this flaw, malicious actors can manipulate JSON mappings to execute arbitrary commands, especially in environments incorporating Spring. Appropriate safeguards and updates are necessary to mitigate risks linked to this vulnerability.

References