Description

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.6",
  "pubDate": "2026-09-01T15:17:37.987Z",
  "pubdate": "2026-09-01T15:17:37.987Z",
  "executiveSummary": "The vulnerability resides in the DefaultBaseTypeLimitingValidator component of the Jackson databind library, specifically concerning polymorphic type resolution.\nBy failing to include java.lang.Comparable in the default blocklist of 'unsafe base types', the validator allows the instantiation of a vast array of attacker-controlled classes when @JsonTypeInfo is utilized.\nThis flaw facilitates an object instantiation primitive that can be leveraged to create arbitrary objects, such as java.io.File, potentially leading to path-traversal-adjacent security bypasses.\nThe issue affects multiple branches of com.fasterxml.jackson.core:jackson-databind (2.11.x through 2.22.x) and tools.jackson.core:jackson-databind (3.0.x through 3.2.x).\nWhile no direct remote code execution (RCE) vector via deserialization alone has been identified, the vulnerability allows an attacker to manipulate application state through unauthorized object creation.\nExploitation requires the application to use @JsonTypeInfo with a base type of java.lang.Comparable without a custom configured PolymorphicTypeValidator.",
  "technicalDetails": "The root cause of this vulnerability is an incomplete denylist within the DefaultBaseTypeLimitingValidator. This validator is automatically applied to @JsonTypeInfo annotations when no custom validator is provided. The validator maintains a list of 'unsafe base types' to restrict polymorphic resolution; however, java.lang.Comparable was omitted from this list.\nBecause a significant proportion of JDK and third-party classes implement the java.lang.Comparable interface—comparable in scope to java.io.Serializable, which is correctly protected—an attacker can bypass security restrictions by leveraging Comparable as the base type for polymorphic deserialization.\nThe attack flow initiates when an application processes JSON data containing a type identifier that resolves to an attacker-chosen class implementing Comparable. The Jackson deserializer, relying on the flawed DefaultBaseTypeLimitingValidator, evaluates the class as 'safe' via the isSafeSubType method, which defaults to true for types not explicitly blocked.\nThis behavior results in an arbitrary object instantiation primitive. For instance, an attacker can supply a serialized payload that instructs Jackson to instantiate java.io.File with a specific file path argument. If the target application later interacts with this instantiated object using path-sensitive methods, the attacker can influence system file access.\nThe vulnerability is restricted to instances where @JsonTypeInfo is explicitly used. Global Default Typing (activateDefaultTyping) is not susceptible to this specific flaw, as it mandates the structural inclusion of an explicit PolymorphicTypeValidator at the point of configuration.\nAffected versions include com.fasterxml.jackson.core:jackson-databind 2.11.0 to 2.18.9, 2.19.0 to 2.21.5, and 2.22.0 to 2.22.1, as well as tools.jackson.core:jackson-databind 3.0.0 to 3.1.5 and 3.2.0 to 3.2.1.\nPost-exploitation impact is contingent upon the availability of gadget classes in the classpath that perform sensitive actions during instantiation or through property setters. While no RCE gadgets have been confirmed, the primitive allows for meaningful application-level abuse, specifically related to file system operations or state corruption."
}