CVE-2026-83557: FasterXML Jackson Databind unsafe polymorphic type deserialization

CVE-2026-83557 · Severity: medium · CVSS 5.6 · Published 2026-09-01

Jackson Databind is a widely-used Java library for converting between JSON and Java objects. When an application uses the @JsonTypeInfo annotation without configuring a custom security validator, Jackson automatically applies a permissive default validator that fails to block unsafe base types like java.lang.Comparable. This flaw allows attackers to instantiate arbitrary classes (such as java.io.File) during deserialization, potentially enabling file path traversal or other object-manipulation attacks depending on how the deserialized object is subsequently used by the application.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-83557 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83557 being exploited in the wild.
How severe is CVE-2026-83557?
Medium severity, with a CVSS score of 5.6, published 1 September 2026.
Which products and versions are affected?
FasterXML Jackson Databind 2.11.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0 before 2.22.2, 3.0.0 before 3.1.6, 3.2.0 before 3.2.2; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.11.0,fixed=2.18.10; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.6.
Is there a fix for CVE-2026-83557?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.10 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83557 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-83557?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.10 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.18.10 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.6 or later
    # set tools.jackson.core:jackson-databind to 3.1.6 in your pom.xml or build.gradle

Technical details

This vulnerability exists in Jackson Databind's DefaultBaseTypeLimitingValidator, which is applied automatically when @JsonTypeInfo is used without an explicit custom PolymorphicTypeValidator. The validator maintains a blocklist of unsafe base types (including java.io.Serializable) but omitted java.lang.Comparable despite it being implemented by a vast fraction of JDK and application classes. An attacker can supply a type identifier for any class implementing Comparable to trigger arbitrary object instantiation. The demonstrated attack constructs java.io.File objects with attacker-controlled paths, enabling path-traversal-adjacent attacks when the application subsequently invokes path-sensitive methods. Code execution through deserialization alone has not been identified. The vulnerability does not affect Global Default Typing via activateDefaultTyping, which structurally requires an explicit PolymorphicTypeValidator argument.

Affected products

  • FasterXML Jackson Databind 2.11.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0 before 2.22.2, 3.0.0 before 3.1.6, 3.2.0 before 3.2.2

Identifiers

  • CVE-2026-83557
  • GHSA-gx83-3vf8-gh7j

Timeline

  • 2026-09-01: disclosed
  • 2026-09-01: patched: Fixes available in versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.