Article
CISA Adds Linux PHP2Shell Chain and VMware ESX Logging Issue to KEV
CISA adds Linux CVE-2026-46300 and VMware ESX CVE-2026-41709 to KEV. Compare their risks, federal due dates, vendor fixes and forensic triage status.
Read more
Vulnerability
Jackson Type Validation Bypass (CVE-2026-110879)
A Critical jackson-databind vulnerability that can bypass type checks when an app reads untrusted JSON.
- CVE ID
- CVE-2026-110879
- CVSS
- 9.8 Critical (CVSS v3.1, maintainer and CNA)
- Affected product
- jackson-databind, Jackson 2.x and 3.x
- Exploited
- Unknown
- Published
- 20 October 2026 (maintainer advisory); 28 October 2026 (CVE record)
In short
CVE-2026-110879 is a Critical jackson-databind vulnerability that can bypass type checks when an app reads untrusted JSON. It lets an attacker choose classes inside generic types or arrays. Command execution depends on the app’s typing settings and the classes it can load. FasterXML lists five patched releases across Jackson 2.x and 3.x.
- CVECVE-2026-110879
- ProductFasterXML jackson-databind, Jackson 2.x and 3.x
- Fix Steps4actions listedCheck the Deployed Package · Install a Fixed Release
What it allows
The maintainer rates CVE-2026-110879 Critical, with a CVSS v3.1 score of 9.8. Jackson checks the outer class named in a type ID but can accept unsafe classes inside its type arguments. Array element types can also bypass the checks. This leaves a gap in the earlier fix for CVE-2026-54512.
The impact depends on the app. An attacker must control JSON that reaches a vulnerable class-name typing path. Those paths include class-name annotations with a default Jackson 3.x mapper, configured default typing in both major versions, and some integrations. A Jackson dependency alone does not prove that an app exposes the vulnerable path.
The advisory describes a Spring example that can run commands as the application account. It needs Spring classes on the classpath and attacker-controlled XML that the app can load. Other examples create or truncate files, make URL requests, or start threads. These are maintainer-described tests, not Brandefense observations of attacks.
For the broader context, see our 2025 CWE Top 25 analysis and H1 2026 vulnerability exploitation trends. For development teams, our developer security guide covers the wider secure coding workflow.
For a separate framework access-control issue, see our Fastify Express middleware bypass profile. It explains why the plugin version and router option must be checked together.
Who is affected
For the Maven package com.fasterxml.jackson.core:jackson-databind, the advisory lists three affected ranges. They are 2.10.0 through 2.18.11, 2.19.0 through 2.21.7, and 2.22.0 through 2.22.3. The corresponding fixed releases are 2.18.12, 2.21.8, and 2.22.4.
For tools.jackson.core:jackson-databind, the affected ranges are 3.0.0 through 3.1.7 and 3.2.0 through 3.2.3. Fixed releases are 3.1.8 and 3.2.4. The package coordinates matter: Jackson 3 uses a different Maven group from Jackson 2.
The maintainer also describes affected default-typing paths exposed through Spring Data Redis and Spring Security integrations. Review the mapper, classpath, and source of serialized data together. A fix for CVE-2026-54512 alone is insufficient: the advisory says its earlier fixed versions still accept the remaining path.
Timeline
- 20 Oct 2026
The maintainer publishes GHSA-m8xf-2cr7-77ph for the remaining type-validation bypass.
- 28 Oct 2026
The CVE record is published, identifying affected package ranges and the earlier incomplete fix.
What to do
-
Check the Deployed Package
Find the jackson-databind package and version in each deployed app. Include copies brought in by other dependencies. Match the Maven group and version to the affected ranges above.
-
Install a Fixed Release
Move the affected package to 2.18.12, 2.21.8, 2.22.4, 3.1.8, or 3.2.4, as appropriate for its branch. Test the change against your app before rollout. Confirm the running build contains the fixed artifact.
-
Review Untrusted JSON Paths
The vendor advises disabling class-name polymorphism for untrusted data when an upgrade must wait. Use narrow subtype rules and stop attackers from writing serialized cache or session values. Remove unused dependencies that can provide unsafe classes.
-
Check the Full Type Rule
The fix validates each class named in a type ID, including type arguments and array elements. Recheck tests that only covered an outer class. Keep evidence of the package version and mapper settings with the remediation record.
Questions
Which Releases Fix CVE-2026-110879?
FasterXML lists jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8, and 3.2.4 as patched releases. Match the release to your Maven package and supported branch.
Does Every Jackson App Allow Remote Command Execution?
No. The demonstrated command-execution path depends on reachable untrusted JSON, class-name typing, Spring classes, and attacker-controlled XML the app can load. Assess the app’s settings and classpath, not just the dependency name.
In our research
Sources
- Jackson Type Validation Bypass: GHSA-m8xf-2cr7-77ph FasterXML
- CVE-2026-110879 Record CVE Program / HeroDevs CNA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 109 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.