Polymorphic Type Validator Weakness in Jackson Databind by FasterXML
CVE-2026-83557

5.6MEDIUM

Key Information:

Vendor

Fasterxml

Status
Jackson-databind
Vendor
CVE Published:
1 September 2026

What is CVE-2026-83557?

A flaw in the DefaultBaseTypeLimitingValidator of Jackson Databind permits polymorphic type resolutions without properly validated base types. This oversight allows an attacker to instantiate objects arbitrarily by exploiting types implementing java.lang.Comparable, leading to potential path traversal vulnerabilities when used in critical file operations. Users of the affected products should upgrade to the specified secure versions to mitigate this risk effectively.

Affected Version(s)

jackson-databind 2.11.0 < 2.18.10

jackson-databind 2.19.0 < 2.21.6

jackson-databind 2.22.0 < 2.22.2

References

https://github.com/FasterXML/jackson-databind/security/ad...
third-party-advisory
https://github.com/FasterXML/jackson-databind/pull/6155
patchissue-tracking
https://github.com/FasterXML/jackson-databind/issues/6156
issue-tracking

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

prvazsahnazarov
Tatu Saloranta (cowtowncoder)
.