CVE-2026-54512Disclosure(fasterxml / jackson-databind)

LOWCVSS 8.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch fasterxml jackson-databind systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

fasterxml CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Weakness type (CWE)

CWE-184CWE-502

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

jackson-databind

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 5 signals
Disclosure: 2 classified signals
Peaked 3d ago at 3 mentions (2026-10-28); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

fasterxml

Products

jackson-databind

Deep dive

Activity timeline7 mentions / 5d

Signal classification3 categories

Disclosure

240.0%

Patch

240.0%

PoC

120.0%

Referenced assets12 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-23	1	Disclosure1
2026-10-28	3	Disclosure1Patch2
2026-10-29	1	PoC1

Full discourse7 posts

dbugs@ptdbugs1d
Bypassing PolymorphicTypeValidator in jackson-databind Read on dbugs: https://dbu.gs/news/bypassing-polymorphictypevalidator-in-jackson-databind-20261106 Vulnerability CVE-2026-110879 (https://dbu.gs/vulnerability/PT-2026-127311?fts=CVE-2026-110879) is an incomplete fix for the previous issue CVE-2026-54512 (https://dbu.gs/vulnerability/PT-2026-51595?fts=CVE-2026-54512) in the jackson-databind library. The attack exploits a logical error in type validation: the validator checks the outer class but fails to validate classes specified in its generic type arguments or as array element types. As a result, an attacker can instantiate an arbitrary class that would have been rejected if specified directly. How it works 1. Entry point: The vulnerability can be triggered when an application deserializes JSON into objects based on class names — either through the "@JsonTypeInfo(use = Id.CLASS)" annotation or when default typing is enabled. 2. Bug in the code: The "DatabindContext._resolveAndValidateGeneric()" method checks the outer class against the declared base type and then passes the arguments from the class-name type ID to "_validateTypeParameter()". This method validates each argument against the outer base type instead of enforcing its corresponding declared generic type. 3. Bypassing the validator: As a result, a dangerous class can be passed «under the guise» of another type, bypassing the validator's checks. If the "allowIfBaseType(...)" rule approves the outer type, Jackson replaces the configured validator with "LaissezFaireSubTypeValidator", which allows all subtypes. Article: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph/ CVE-2026-110879 — PT-2026-127311: https://dbu.gs/vulnerability/PT-2026-127311 CVE-2026-54512 — PT-2026-51595: https://dbu.gs/vulnerability/PT-2026-51595
10031362
4.1K followersView on X
VulnTracker@vuln_tracker10d
Patch
Jackson Databind CVE-2026-110879 (CVSS 9.8): type validator bypass, an incomplete fix for CVE-2026-54512. RCE possible with a suitable gadget. VulnTracker recommends upgrading to 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. Details: https://vulntracker.io/cves/CVE-2026-110879 #Jackson #Java #CVE https://t.co/Dtv8rjrkbd
Post summary
The tweet discloses a critical (CVSS 9.8) Jackson Databind vulnerability (CVE‑2026‑110879) involving a type validator bypass that could lead to RCE, and advises upgrading to specific patched versions (2.18.12, 2.21.8, 2.22.4, 3.1.8, or 3.2.4).
10040270
901 followersView on X
SecAlerts@SecAlertsCo4d
☕ jackson-databind CVE-2026-110879 (CVSS 9.8): PolymorphicTypeValidator bypassed via generic type args, allowing arbitrary class instantiation. Incomplete fix for CVE-2026-54512. Patch now. #cybersecurity #ciso #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-110879?utm_campaign=x
0000167
897 followersView on X
Daily CyberSecurity@Daily_CyberSec9d
PoC
Details and a PoC exploit are public for jackson-databind vulnerability CVE-2026-110879 (CVSS 9.8), a bypass of the CVE-2026-54512 fix. Patch now. #Jackson #jacksondatabind #Java #CVE2026110879 #Deserialization #PoC #Spring #AppSec https://securityonline.info/jackson-databind-vulnerability-cve-2026-110879-poc/
Post summary
The tweet announces that details and a PoC exploit are public for the jackson-databind vulnerability CVE-2026-110879, which has a CVSS score of 9.8 and bypasses a previous fix, while urging users to patch now.
00010409
13.1K followersView on X
Severity Daily@severitydaily10d
Disclosure
A class jackson-databind rejects as a type ID is accepted when wrapped in a generic, and the releases its June advisory named as the fix still accept it. Scored 9.8. No exploitation reported. https://severitydaily.com/jackson-databind-cve-2026-110879-incomplete-fix-cve-2026-54512-2-18-12-2-21-8-2-22-4-no-2-19-2-20-patch/
Post summary
The text discloses jackson-databind CVE-2026-110879 vulnerability details with a CVSS 9.8 score and explicitly states no exploitation is reported; it mentions an incomplete June advisory fix but does not present a working patch or exploit, classifying it as a disclosure of the vulnerability and its inadequate remediation.
0000027
32 followersView on X
Eliran Emuna@EmunaEliran10d
Patch
🚨 jackson-databind: CVE-2026-110879, CVSS 3.1 9.8 (CNA) ⚠️ Validator bypass via generic type args & array element types → arbitrary class instantiation 🔁 Incomplete fix for CVE-2026-54512 ✅ Fixed: 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4 🔗 https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph #Java #AppSec https://t.co/9fjSJq7naV
Post summary
The tweet highlights a critical vulnerability in jackson-databind and specifies the versions that contain the fix.
0000032
76 followersView on X
DailyCVE@dailycve137d
Disclosure
🔴 Jackson-databind PolymorphicTypeValidator Bypass via Generic Type Parameters (#CVE-2026-54512) — High Severity -DC-Jun2026-608 https://dailycve.com/jackson-databind-polymorphictypevalidator-bypass-via-generic-type-parameters-cve-2026-54512-high-severity-dc-jun2026-608/
Post summary
High severity vulnerability disclosed that bypasses Jackson-databind’s PolymorphicTypeValidator through generic type parameters; no PoC, exploit, or patch details available.
0000036
216 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	fasterxml	jackson-databind	-	-	-

Explore more

Back to dashboard fasterxml CVEs jackson-databind vulnerabilities

What researchers are saying

CVE-2026-54512

VulnTracker[verified]@vuln_trackerPatch

The tweet discloses a critical (CVSS 9.8) Jackson Databind vulnerability (CVE‑2026‑110879) involving a type validator bypass that could lead to RCE, and advises upgrading to specific patched versions (2.18.12, 2.21.8, 2.22.4, 3.1.8, or 3.2.4).

Severity Daily[verified]@severitydailyDisclosure

The text discloses jackson-databind CVE-2026-110879 vulnerability details with a CVSS 9.8 score and explicitly states no exploitation is reported; it mentions an incomplete June advisory fix but does not present a working patch or exploit, classifying it as a disclosure of the vulnerability and its inadequate remediation.

Eliran Emuna[verified]@EmunaEliranPatch

The tweet highlights a critical vulnerability in jackson-databind and specifies the versions that contain the fix.

Daily CyberSecurity@Daily_CyberSecPoC

The tweet announces that details and a PoC exploit are public for the jackson-databind vulnerability CVE-2026-110879, which has a CVSS score of 9.8 and bypasses a previous fix, while urging users to patch now.

DailyCVE@dailycveDisclosure

High severity vulnerability disclosed that bypasses Jackson-databind’s PolymorphicTypeValidator through generic type parameters; no PoC, exploit, or patch details available.