Deserialization of Untrusted Data in jackson-databind - CVE-2026-83557

Vulnerability identifier: #VU146540

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-83557

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to instantiate an unintended object and disclose, modify, or affect data handling.

The vulnerability exists due to deserialization of untrusted data in DefaultBaseTypeLimitingValidator when processing polymorphic type identifiers for @JsonTypeInfo-annotated Comparable-typed values without a custom PolymorphicTypeValidator. A remote attacker can supply a crafted type identifier to instantiate an attacker-chosen Comparable implementation to disclose, modify, or affect data handling.

Only the default, unconfigured validator path reached through bare @JsonTypeInfo usage is affected; configurations using activateDefaultTyping() with an explicit restrictive PolymorphicTypeValidator are not affected.

jackson-databind
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Development Tools Module
Basesystem Module
Fedora
Rational Test Virtualization Server
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM SPSS Modeler
IBM Business Automation Workflow
IBM Netezza Performance Server
Db2 Developer Extension
Quantum Safe Explorer
CICS Transaction Gateway Desktop Edition
Security Verify Governance Adapter for CyberArk
Terracotta
DevOps Test Virtualization
DevOps Test Integrations and APIs
IBM Engineering Systems Design Rhapsody
InfoSphere Data Replication
Guardium Data Protection
IBM Cloud Pak System
IBM App Connect Enterprise
jackson-parent
jackson-annotations
jackson-dataformat-cbor
jackson-core
jackson-databind
jackson-dataformat-xml
jackson-modules-base
jackson-jaxrs-providers
jackson-bom
fasterxml-oss-parent

Install security update from vendor's website.

jackson-databind - addressed in versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2
Db2 Developer Extension - update to 1.2.1
Quantum Safe Explorer - update to 2.3.3
IBM Cloud Pak System - update to 2.3.6.2
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.32, 9.1.25, 9.2.4
Terracotta - addressed in versions 10.15.0.40, 11.1.0.23, 12.1.0.5
DevOps Test Virtualization - update to 12.0.0
DevOps Test Integrations and APIs - update to 12.0.0
IBM App Connect Enterprise - addressed in versions 12.0.12.30, 13.0.9.0
IBM SPSS Modeler - update to 19.0.0.0 IF035
jackson-parent - update to 2.18.4-1.fc44
jackson-annotations - update to 2.18.11-150200.3.28.1
jackson-dataformat-cbor - update to 2.18.11-150200.3.29.1
jackson-core - update to 2.18.11-150200.3.30.1
jackson-databind - update to 2.18.11-150200.3.36.1
jackson-dataformat-xml - update to 2.18.11-150200.5.8.1
jackson-modules-base - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-jaxrs-providers - update to 2.18.12-1.fc44
jackson-databind - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-core - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-bom - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-annotations - update to 2.18.12-1.fc44
fasterxml-oss-parent - update to 69-1.fc44
IBM Engineering Systems Design Rhapsody - addressed in versions 10.0.0.6, 10.0.1.0.7, 10.0.2.0.5, 10.0.3.0.2
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826
Guardium Data Protection - update to 12.0p237

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j

• Remote code execution in FasterXML jackson-databind
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Quantum Safe Explorer
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Netezza Performance Server
• Multiple vulnerabilities in IBM Security Verify Governance Adapter for CyberArk
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Db2 Developer Extension
• Multiple vulnerabilities in IBM Guardium Data Protection
• Multiple vulnerabilities in IBM Terracotta
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM SPSS Modeler
• Multiple vulnerabilities in IBM DevOps Test Virtualization/IBM DevOps Test Integrations and APIs
• Fedora 46 update for jackson-bom, jackson-core, jackson-databind, jackson-modules-base
• Fedora 45 update for jackson-bom, jackson-core, jackson-databind, jackson-modules-base
• Fedora 44 update for fasterxml-oss-parent, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-jaxrs-providers, jackson-modules-base, jackson-parent
• Multiple vulnerabilities in InfoSphere Data Replication
• Multiple vulnerabilities in IBM CICS Transaction Gateway Desktop Edition
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• SUSE update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base