Skip to content
Fencer Vulns
critical 9.8

CVE-2026-110879 json

jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

published 2026-10-28 12 d ago modified 2026-11-06 2 d ago also EUVD-2026-111532

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix.

DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the type ID to _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing its corresponding declared generic binding. It also invokes validators with arguments that have not passed the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID. Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's base type is approved.

Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that expose that default typing. The default-validator case requires no application-authored validator: with @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as "Not a subtype", while a type ID naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied bean properties. Where class-name default typing permits Map, a property declared as Map<String,String> accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath and attacker-controlled XML the application can load, that constructor loads the XML and invokes ProcessBuilder.start() under the application account, giving arbitrary command execution.

This issue affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in jackson-databind 2.10.0.

Patch / fix

  • FasterXML jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4
  • jackson-databind Debian 14 2.22.4-1

debian advisories DEBIAN-CVE-2026-110879

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-110879 updated cvss 8.1

jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types

  • Red Hat AMQ Broker 7 jackson-databind 2.22.1.redhat-00003 Red Hat build of Apache Camel - HawtIO 4 jackson-databind 2.22.1.redhat-00003 Red Hat build of Apache Camel 4 for Quarkus 3 jackson-databind 2.22.1.redhat-00003 Red Hat build of Apache Camel for Spring Boot 4 jackson-databind 2.22.1.redhat-00003 Red Hat build of Apicurio Registry 3 jackson-databind 2.22.1.redhat-00003 Red Hat build of Debezium 3 jackson-databind 2.22.1.redhat-00003
    affected: workaround, no fix available
  • Red Hat Ceph Storage 7 liborc1 Red Hat Ceph Storage 8 liborc1 Red Hat Ceph Storage 9 liborc, liborc2, libarrow, parquet-libs
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Data Grid 8 jackson-databind 2.22.1.redhat-00003
    affected: workaround, no fix available
  • Red Hat Fuse 7 jackson-databind 2.22.1.redhat-00003 Red Hat JBoss Enterprise Application Platform 7 jackson-databind 2.22.1.redhat-00003, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, jboss-eap-7/eap74-els-openjdk11-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss Enterprise Application Platform 8 jackson-databind 2.22.1.redhat-00003
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 jackson-databind 2.22.1.redhat-00003
    affected: workaround, no fix available “Fix deferred”
  • Red Hat streams for Apache Kafka 3 jackson-databind 2.22.1.redhat-00003
    affected: workaround, no fix available
  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9 Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins, ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, +4 more Red Hat AI Inference Server rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9 Red Hat Ansible Automation Platform 2 python-drools-jpy-jar, python3x-drools-jpy-jar, python3.11-drools-jpy-jar, python3.12-drools-jpy-jar, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, +5 more Red Hat Certificate System 10 redhat-pki
    +11 more products
    Red Hat Certificate System 11 redhat-pki Red Hat Enterprise Linux 8 jss, pki-ca, idm-jss, ldapjdk, pki-kra, pki-acme, +25 more Red Hat Enterprise Linux 9 pki-ca, pki-kra, pki-acme, pki-base, pki-core, pki-tools, +16 more Red Hat Enterprise Linux 10 dogtag-pki, assertj-core Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9 Red Hat JBoss Web Server 7 jboss-webserver-7/jws70-openjdk17-openshift-rhel9, jboss-webserver-7/jws70-openjdk21-openshift-rhel9 Red Hat Lightspeed for Runtimes Operator rh-lightspeed-runtimes/runtimes-agent-init-rhel9 Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-trustyai-service-rhel9, rhoai/odh-th-torch-cpu-py312-rhel9, rhoai/odh-th-torch-cuda-py312-rhel9, +6 more Red Hat OpenShift Dev Spaces devspaces/server-rhel9, devspaces/openvsx-rhel9, devspaces/pluginregistry-rhel9, devspaces/multicluster-redirector-rhel9 Red Hat Satellite 6 candlepin, openvox-server, candlepin-selinux
    under investigation
show 8 more
  • Red Hat Build of Apache Camel 3.33.4.SP1 jackson-databind 2.21.8.redhat-00001
    fixed: vendor fix RHSA-2026:91304
  • Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9 26.4-29, rhbk/keycloak-rhel9-operator 26.4-30, rhbk/keycloak-operator-bundle 26.4.17-2
    fixed: vendor fix RHSA-2026:95760
  • Red Hat build of Keycloak 26.4.17
    fixed: vendor fix RHSA-2026:95759
  • Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-24, rhbk/keycloak-rhel9-operator 26.6-24, rhbk/keycloak-operator-bundle 26.6.8-2
    fixed: vendor fix RHSA-2026:95762
  • Red Hat build of Keycloak 26.6.8
    fixed: vendor fix RHSA-2026:95761
  • Red Hat build of Quarkus 3.27.6.SP1
    fixed: vendor fix RHSA-2026:90290
  • Red Hat build of Quarkus 3.33.4.SP1
    fixed: vendor fix RHSA-2026:90311
  • Red Hat Build of Apache Camel 3.33.4.SP1 jimfs 1.1, jna 5.8.0, bcel 6.7.0, gax 2.74.1, icu4j 78.2, joni 2.2.6, +1616 more
    not affected: vulnerable code not present

2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 d ago

Exploit prediction

1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • FasterXML jackson-databind

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.