42 matches found
EUVD-2026-69250
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types incomplete PolymorphicTypeValidator denylist...
SUSE CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
Deserialization of Untrusted Data
Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType method of...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType method of DefaultBaseTypeLimitingValidator, whose denylist of unsafe base types omits java.lang.Comparable, so the method returns true for any subtype resolved under a Comparable...
DEBIAN-CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557
jackson-databind ships a default PolymorphicTypeValidator (DefaultBaseTypeLimitingValidator) used automatically when @JsonTypeInfo is present without a custom validator. The flaw: java.lang.Comparable was omitted from its "unsafe base types" deny-list, so isSafeSubType returned true unconditional...
CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
PT-2026-84291
Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.core:jackson-databind versions 2.11.0 through 2.18.9 com.fasterxml.jackson.core:jackson-databind versions 2.19.0 through 2.21.5 com.fasterxml.jackson.core:jackson-databind versions 2.22.0 through 2.22.1...
Malicious code in comparable_dormouse_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01029bf5cad48a4efb9f84dd25e81a2ef705a98d3b399161d3c01d62613ffa18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-106027
Malicious code in comparablemarsupialz3n npm...
EUVD-2025-92695
Malicious code in comparablemoosez3n npm...
EUVD-2025-77297
Malicious code in comparableworm-appteadev npm...
Malicious code in comparable_mole_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8499f52a187d599ad9c72ff1cf214fb0e6733cdd877c5e30170021c47cfaba7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-82441
Malicious code in comparableostrich0xrequest npm...
EUVD-2025-82443
Malicious code in comparablebuzzardreplicateautomation npm...