CVE-2026-83557

Overview

jackson-databind is the general-purpose data-binding package of the FasterXML Jackson suite. It provides full data-binding (object serialization and deserialization) on top of the Jackson streaming parser/generator (jackson-core) and the Jackson annotations (jackson-annotations), and is one of the most widely used JSON libraries for Java.

A deserialization vulnerability (CVE-2026-83557) has been identified in jackson-databind, which allows attackers who control JSON bound to a java.lang.Comparable-typed polymorphic property to have a class of their choosing instantiated, bypassing the protection that DefaultBaseTypeLimitingValidator is meant to provide against unsafe polymorphic base types. Because Comparable is implemented by a very large fraction of JDK and application classes, the type identifier embedded in the attacker's JSON can select essentially any Comparable-implementing class.

Under CWE-502, Deserialization of Untrusted Data, this entry covers cases where the product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

This issue affects multiple versions of jackson-databind: 2.x releases from 2.11.0 up to and including 2.18.9, from 2.19.0 up to and including 2.21.5, and from 2.22.0 up to and including 2.22.1, as well as 3.x releases prior to 3.1.6 and 3.2.x releases prior to 3.2.2.

Details

Module Info

• Product: jackson-databind
• Affected packages: com.fasterxml.jackson.core:jackson-databind (2.x), tools.jackson.core:jackson-databind (3.x)
• Affected versions:
• com.fasterxml.jackson.core:jackson-databind: >=2.11.0 <2.18.10, >=2.19.0 <2.21.6, >=2.22.0 <2.22.2
• tools.jackson.core:jackson-databind: >=3.0.0 <3.1.6, >=3.2.0 <3.2.2
• GitHub repository: https://github.com/FasterXML/jackson-databind
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-databind
• Package manager: Maven
• Fixed in:
  
  • NES for Jackson 2.13.10, 2.14.7, and 2.15.8
  • OSS 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2

Vulnerability Info

This Medium-severity vulnerability is found in the com.fasterxml.jackson.core:jackson-databind package in multiple 2.x and 3.x versions of jackson-databind. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator that jackson-databind supplies to guard polymorphic deserialization: it denies a fixed denylist of known-dangerous base types and then accepts every subtype of any base type that is not on the list (isSafeSubType unconditionally returns true). The denylist omits java.lang.Comparable:

private final Set<String> UNSAFE = new HashSet<>();
{
    // first add names of types in `java.base`
    UNSAFE.add(Object.class.getName());
    UNSAFE.add(java.io.Closeable.class.getName());
    UNSAFE.add(java.io.Serializable.class.getName());
    UNSAFE.add(AutoCloseable.class.getName());
    UNSAFE.add(Cloneable.class.getName());

    // and then couple others typically included in JDK, but that we
    // prefer not adding direct reference to
    UNSAFE.add("java.util.logging.Handler");
    UNSAFE.add("javax.naming.Referenceable");
    UNSAFE.add("javax.sql.DataSource");
}

On the 2.x lines this validator becomes the active validator when an application enables MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES, the hardening opt-in intended to block exactly this kind of overly broad polymorphic base type; on the 3.x lines it is engaged by default for a bare @JsonTypeInfo annotation. An application that has opted into the hardening and exposes a @JsonTypeInfo-annotated property typed as java.lang.Comparable (or another broad interface missing from the list) therefore believes unsafe base types are blocked, yet the validator accepts a class-name type identifier for any Comparable-implementing class in the JSON it deserializes. This hands the attacker a controlled object instantiation primitive: the selected class is loaded and constructed with attacker-supplied content, and the practical consequences grow with the constructors, setters, and creator logic of the classes available on the application classpath.

Steps to Reproduce

1. Put an affected jackson-databind release (for example 2.15.4) on the classpath of a small Java program.

2. Declare a bean with a Comparable-typed property annotated with @JsonTypeInfo, and enable MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES so that DefaultBaseTypeLimitingValidator is the active validator.

3. Deserialize a JSON payload whose type identifier names a class the developer never intended to accept:

public class Holder {
    @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
    public Comparable<?> value;
}

ObjectMapper mapper = new ObjectMapper();
mapper.enable(MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES);
Holder h = mapper.readValue("{\"value\":[\"java.io.File\",\"/etc/passwd\"]}", Holder.class);
System.out.println(h.value.getClass().getName()); // java.io.File

4. On affected versions the call succeeds and instantiates java.io.File with the attacker-chosen path. On a fixed release the same payload is rejected with an InvalidDefinitionException denying resolution of all subtypes of java.lang.Comparable.

Mitigation

Only recent versions of Jackson are community-supported. The affected 2.13.x, 2.14.x, and 2.15.x lines are End-of-Life and will not receive public updates to address this issue. There is no publicly available fix for these lines; NES for Jackson is the remedy.

Users of the affected components should apply one of the following mitigations:

• Upgrade jackson-databind to a currently supported 2.x release that contains the fix, such as 2.18.10 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• prvazsahnazarov (finder)