TI-2026-57688 Aliases CVE-2026-83557 GHSA-gx83-3vf8-gh7j

jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

MEDIUM 58CWE-502Published 2026-09-01 · Updated 2026-09-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution, Tampering
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Partial Red Hat: 2 fixed, 33 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502 and CWE-915.

Summary

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00717 54th percentileScored 2026-11-07

Fix Partial jackson-databind (FasterXML): 2.18.10, 2.21.6, 2.22.2 +2tools.jackson.core:jackson-databind (Maven): 3.1.6, 3.2.2+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 33 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
FasterXML	jackson-databind	2.11.0 to before 2.18.10; 2.19.0 to before 2.21.6; 2.22.0 to before 2.22.2	2.18.10, 2.21.6, 2.22.2	Patch available	CNA
FasterXML	jackson-databind	3.0.0 to before 3.1.6; 3.2.0 to before 3.2.2	3.1.6, 3.2.2	Patch available	CNA
—	tools.jackson.core:jackson-databind (Maven)	3.0.0 to before 3.1.6	3.1.6	Patch available	GHSA-gx83-3vf8-gh7j
—	tools.jackson.core:jackson-databind (Maven)	3.2.0 to before 3.2.2	3.2.2	Patch available	GHSA-gx83-3vf8-gh7j
—	com.fasterxml.jackson.core:jackson-databind (Maven)	2.11.0 to before 2.18.10	2.18.10	Patch available	GHSA-gx83-3vf8-gh7j
—	com.fasterxml.jackson.core:jackson-databind (Maven)	2.19.0 to before 2.21.6	2.21.6	Patch available	GHSA-gx83-3vf8-gh7j
—	com.fasterxml.jackson.core:jackson-databind (Maven)	2.22.0 to before 2.22.2	2.22.2	Patch available	GHSA-gx83-3vf8-gh7j

jackson-databind VendorFasterXML Affected 2.11.0 to before 2.18.10; 2.19.0 to before 2.21.6; 2.22.0 to before 2.22.2 Fixed in 2.18.10, 2.21.6, 2.22.2 Patch available CNA
jackson-databind VendorFasterXML Affected 3.0.0 to before 3.1.6; 3.2.0 to before 3.2.2 Fixed in 3.1.6, 3.2.2 Patch available CNA
tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.6 Fixed in 3.1.6 Patch available GHSA-gx83-3vf8-gh7j
tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.2.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-gx83-3vf8-gh7j
com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.11.0 to before 2.18.10 Fixed in 2.18.10 Patch available GHSA-gx83-3vf8-gh7j
com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.19.0 to before 2.21.6 Fixed in 2.21.6 Patch available GHSA-gx83-3vf8-gh7j
com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.22.0 to before 2.22.2 Fixed in 2.22.2 Patch available GHSA-gx83-3vf8-gh7j

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:fasterxml:jackson-databind::::::::	—	—	FasterXML

cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions — — ·FasterXML

Remediation

Fix · CNA jackson-databind (FasterXML) Fixed in 2.18.10, 2.21.6, 2.22.2
Fix · CNA jackson-databind (FasterXML) Fixed in 3.1.6, 3.2.2
Fix · GHSA-gx83-3vf8-gh7j tools.jackson.core:jackson-databind (Maven) Fixed in 3.1.6 Advisory →
Fix · GHSA-gx83-3vf8-gh7j tools.jackson.core:jackson-databind (Maven) Fixed in 3.2.2 Advisory →
Fix · GHSA-gx83-3vf8-gh7j com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.18.10 Advisory →
Fix · GHSA-gx83-3vf8-gh7j com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.21.6 Advisory →
Fix · GHSA-gx83-3vf8-gh7j com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.22.2 Advisory →

Red Hat 2 advisories

RHSA-2026:83520 Released 2026-10-15 · Red Hat rating Important
Red Hat build of Quarkus 3.33.4 release and security update
- Red Hat build of Quarkus 3.33.4.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +10
RHSA-2026:83082 Released 2026-10-15 · Red Hat rating Important
Red Hat build of Quarkus 3.27.6 release and security update
- Red Hat build of Quarkus 3.27.6.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-01
FasterXML jackson-databind 2.18.10, 2.21.6 and 3 more versions
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-15553 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.PathPriority MEDIUM 63
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Exploit Intelligence	Affected	No fix planned: Out of support scope
OpenShift Developer Tools and Services	Affected	No fix planned: Out of support scope
OpenShift Serverless	Affected	No fix yet: Fix deferred
Red Hat AI Inference Server	Affected	No fix yet: Fix deferred
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat Build of Keycloak	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 6	Affected	No fix planned: Out of support scope
Red Hat Ceph Storage 7	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 8	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 9	Affected	No fix yet: Fix deferred
Red Hat Certificate System 10	Affected	No fix planned: Out of support scope
Red Hat Certificate System 11	Affected	No fix yet: Fix deferred
Red Hat Data Grid 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 7	Affected	No fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat JBoss Web Server 7	Affected	No fix yet: Fix deferred
Red Hat Lightspeed for Runtimes Operator	Affected	No fix yet: Fix deferred
Red Hat Offline Knowledge Portal	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix yet: Fix deferred
Red Hat Single Sign-On 7	Affected	No fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Red Hat build of Apicurio Registry 3	Affected	No fix planned: Out of support scope
Red Hat build of Debezium 3	Affected	No fix yet: Fix deferred
Red Hat build of Quarkus 3.27.6.redhat	Fixed	RHSA-2026:83082
Red Hat build of Quarkus 3.33.4.redhat	Fixed	RHSA-2026:83520

Not affected: 3 products

Red Hat Hardened Images
Red Hat build of Quarkus 3.27.6.redhat
Red Hat build of Quarkus 3.33.4.redhat

Timeline

2026-10-02 Threatist record created from CVE-2026-83557
2026-10-03 Alias added: GHSA-gx83-3vf8-gh7j
2026-10-16 Fix available: RHSA-2026:83520 · Red Hat
2026-10-16 Fix available: RHSA-2026:83082 · Red Hat
2026-10-16 Fix available: Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat · Red Hat

References

Patch 2

Advisory 2

Other 7

TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5

See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences