{"vulnerability": "cve-2026-83557", "sightings": [{"uuid": "a635093b-f90e-4a1a-b08a-56740f776d3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-83557", "type": "seen", "source": "https://gist.github.com/alon710/35d5e2c33136dbb7a12b708378d3cde0", "content": "# CVE-2026-83557: CVE-2026-83557: Polymorphic Deserialization Bypass in FasterXML jackson-databind via java.lang.Comparable\n\n> **CVSS Score:** 5.6\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-83557\n\n## Summary\nAn incomplete denylist vulnerability in FasterXML jackson-databind's DefaultBaseTypeLimitingValidator allows unauthenticated remote attackers to bypass polymorphic type limitations. By declaring properties of type java.lang.Comparable, attackers can instantiate arbitrary Comparable subclasses on the classpath, leading to path traversal, local file access, or application-specific state manipulation.\n\n## TL;DR\nIncomplete polymorphic type validation in Jackson Databind allows arbitrary object instantiation of Comparable subtypes, exposing applications to file path validation bypasses and class loading attacks.\n\n## Technical Details\n\n- **CWE ID**: CWE-502 / CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.6 (Medium)\n- **EPSS Score**: 0.00586 (Percentile: 46.72%)\n- **Impact**: Arbitrary Object Instantiation / Bypass\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- FasterXML jackson-databind (com.fasterxml.jackson.core)\n- FasterXML jackson-databind (tools.jackson.core)\n- **com.fasterxml.jackson.core:jackson-databind**: >= 2.11.0, < 2.18.10 (Fixed in: `2.18.10`)\n- **com.fasterxml.jackson.core:jackson-databind**: >= 2.19.0, < 2.21.6 (Fixed in: `2.21.6`)\n- **com.fasterxml.jackson.core:jackson-databind**: >= 2.22.0, < 2.22.2 (Fixed in: `2.22.2`)\n- **tools.jackson.core:jackson-databind**: >= 3.0.0, < 3.1.6 (Fixed in: `3.1.6`)\n- **tools.jackson.core:jackson-databind**: >= 3.2.0, < 3.2.2 (Fixed in: `3.2.2`)\n\n## Mitigation\n\n- Upgrade jackson-databind to the latest secure version (2.18.10+, 2.21.6+, 2.22.2+, 3.1.6+, or 3.2.2+)\n- Avoid utilizing wide-reaching interfaces like java.lang.Comparable for polymorphic deserialization properties\n- Implement a strict BasicPolymorphicTypeValidator allowlist to specify allowed subtypes explicitly\n\n**Remediation Steps:**\n1. Audit application classpaths and find jackson-databind dependencies within build files (pom.xml, build.gradle)\n2. Update the jackson-databind version to one of the patched releases\n3. Scan codebase for properties annotated with @JsonTypeInfo where the declared type implements java.lang.Comparable\n4. Replace wide property types with narrow, concrete domain transfer classes\n\n## References\n\n- [GitHub Security Advisory GHSA-gx83-3vf8-gh7j](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j)\n- [Fix Commit eb3b7fc0f](https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f)\n- [GitHub Issue #6156](https://github.com/FasterXML/jackson-databind/issues/6156)\n- [GitHub Pull Request #6155](https://github.com/FasterXML/jackson-databind/pull/6155)\n- [CVE-2026-83557 Record](https://www.cve.org/CVERecord?id=CVE-2026-83557)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-83557)\n- [Wiz Vulnerability Analysis Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-83557)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-83557) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-28T21:30:32.000000Z"}, {"uuid": "08724c5e-6978-4946-bc09-8651dccc8e61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83557", "type": "published-proof-of-concept", "source": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j", "content": "", "creation_timestamp": "2026-09-01T03:04:35.000000Z"}]}