Deserialization of Untrusted Data in jackson-databind - CVE-2026-83557
Published: September 1, 2026
Vulnerability details
The vulnerability allows a remote attacker to instantiate an unintended object and disclose, modify, or affect data handling.
The vulnerability exists due to deserialization of untrusted data in DefaultBaseTypeLimitingValidator when processing polymorphic type identifiers for @JsonTypeInfo-annotated Comparable-typed values without a custom PolymorphicTypeValidator. A remote attacker can supply a crafted type identifier to instantiate an attacker-chosen Comparable implementation to disclose, modify, or affect data handling.
Only the default, unconfigured validator path reached through bare @JsonTypeInfo usage is affected; configurations using activateDefaultTyping() with an explicit restrictive PolymorphicTypeValidator are not affected.
Affected software
IBM Engineering Systems Design Rhapsody
How to mitigate CVE-2026-83557
IBM Engineering Systems Design Rhapsody - addressed in versions 10.0.0.6, 10.0.1.0.7, 10.0.2.0.5, 10.0.3.0.2