jackson-databind hit with CVSS 9.8 flaw CVE-2026-110879, bypassing prior fix
Kyrannio · x · 2026-10-28
A new vulnerability, CVE-2026-110879 (CVSS 9.8), has been disclosed in FasterXML's jackson-databind Java library.
- How it works: The library validates only the outer class of a class-name type ID but accepts attacker-selected classes inside generic type arguments and array element types, bypassing PolymorphicTypeValidator checks. Attackers who can supply JSON input can instantiate classes that should be blocked, potentially executing unintended code. Annotation-based polymorphism and configured default typing are both affected.
- Incomplete fix: This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm); resolveAndValidateGeneric() validates arguments against the outer base type rather than their declared generic bindings.
- Fixed in: 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4. No public exploit yet, and not listed in CISA KEV.
More from coding & agent
- Early users praise DeckWerk after weeks of using it for real talks — vincesitzmann · 2026-10-28
- Agentic video editing goes pro: senior editors 5x output, costs to collapse — dotey · 2026-10-28
- Software is going agent-first: sites, browsers, even a new Rust-like language built for agents — mobileraj · 2026-10-28
- HABIT-Bench: Best agent memory system scores just 33.61% at inferring user habits — SJTU · 2026-10-28
- Regehr's 'Piano Test': would you trust formally verified code with your life? — moyix · 2026-10-28
- Vibe-coded 'AI 浮生记' game satirizes AI startup life with compute black-market trading — vista8 · 2026-10-28