jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

[ Fixes ]Fixes and patches

• tools.jackson.core:jackson-databind 3.1.6Fixed version · GitHub Advisories · maven package tools.jackson.core:jackson-databind: upgrade to 3.1.6 or later (affected >= 3.0.0, < 3.1.6)
• tools.jackson.core:jackson-databind 3.2.2Fixed version · GitHub Advisories · maven package tools.jackson.core:jackson-databind: upgrade to 3.2.2 or later (affected >= 3.2.0, < 3.2.2)
• com.fasterxml.jackson.core:jackson-databind 2.18.10Fixed version · GitHub Advisories · maven package com.fasterxml.jackson.core:jackson-databind: upgrade to 2.18.10 or later (affected >= 2.11.0, < 2.18.10)
• com.fasterxml.jackson.core:jackson-databind 2.21.6Fixed version · GitHub Advisories · maven package com.fasterxml.jackson.core:jackson-databind: upgrade to 2.21.6 or later (affected >= 2.19.0, < 2.21.6)
• com.fasterxml.jackson.core:jackson-databind 2.22.2Fixed version · GitHub Advisories · maven package com.fasterxml.jackson.core:jackson-databind: upgrade to 2.22.2 or later (affected >= 2.22.0, < 2.22.2)

[ Advisories ]Government CERT advisories

• CERT-FR16 Oct 2026CERTFR-2026-AVI-1336

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs
• CERT-FR9 Oct 2026CERTFR-2026-AVI-1291

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-49978CVE-2025-27895CVE-2026-59651+195 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1249

  Multiple vulnerabilities in VMware products Translated from French

  Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1256

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-27980CVE-2026-58055CVE-2026-49978+360 more CVEs
• BSI CERT-Bund27 Sep 2026WID-SEC-2026-3595

  IBM QRadar SIEM: Multiple vulnerabilities Translated from German

  CVE-2025-54518CVE-2026-44186CVE-2026-59878+151 more CVEs

[ Packages ]Affected open-source packages

• tools.jackson.core:jackson-databind mavenAffected >= 3.0.0, < 3.1.6 · fixed in 3.1.6 · GHSA-gx83-3vf8-gh7j
• tools.jackson.core:jackson-databind mavenAffected >= 3.2.0, < 3.2.2 · fixed in 3.2.2 · GHSA-gx83-3vf8-gh7j
• com.fasterxml.jackson.core:jackson-databind mavenAffected >= 2.11.0, < 2.18.10 · fixed in 2.18.10 · GHSA-gx83-3vf8-gh7j
• com.fasterxml.jackson.core:jackson-databind mavenAffected >= 2.19.0, < 2.21.6 · fixed in 2.21.6 · GHSA-gx83-3vf8-gh7j
• com.fasterxml.jackson.core:jackson-databind mavenAffected >= 2.22.0, < 2.22.2 · fixed in 2.22.2 · GHSA-gx83-3vf8-gh7j

[ References ]References

• github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7jthird-party-advisory
• github.com/FasterXML/jackson-databind/pull/6155patchissue-tracking
• github.com/FasterXML/jackson-databind/issues/6156issue-tracking
• github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388fpatch