Vulnerabilities

TI-2026-57688 CVE-2026-83557 · GHSA-gx83-3vf8-gh7j

jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

MEDIUM 58

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.00717 Published 2026-09-01 Partial fix · 2.18.10, 2.21.6 +3 CWE-502

TI-2026-15553 CVE-2026-19032 · GHSA-wjgm-6hv5-3cvf

jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

MEDIUM 63

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00572 Published 2026-09-01 Partial fix · 2.18.10, 2.21.6 +3 CWE-470

Vulnerabilities

Filters

jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path