FasterXML
CVE-2026-110879: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes v
CVE-2026-110879 Oct 28, 2026 Source: Vendor
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix.
DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the typ
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-110879
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2 matching , clear filters
CVE-2026-110879
BR2026-0000-036457
unclaimed
Credited as martinfrancois
CVE-2026-110879
BR2026-0000-036458
unclaimed
Credited as AdamKorcz