CVE-2019-12086-jackson-databind-file-read

jackson-CVE-2019-12086 Vulnerability Description When Default Typing is enabled, and the classpath contains mysql-connector-java version 8.0.15 released on 2019.2.1 or earlier, an attacker can read arbitrary files by sending malicious JSON data. The mysql-connector-java library is the commonly us...

CLEANSTART-2026-NN88858 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-RV05349 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-PS95562 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-RO69102 Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2...

CLEANSTART-2026-UF85195 Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2...

CLEANSTART-2026-QU95905 Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2...

CLEANSTART-2026-TS69470 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-BN96134 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-JD21089 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091360 advisory. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled either globally or for a specific property f...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091397)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091397 advisory. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. Tenable has extracted the...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...