Jackson Databind EUVD-2026-111532

Exploitation requires the application to perform class-name polymorphic deserialization of attacker-controlled JSON through one of several concrete paths: annotation-based polymorphism using @JsonTypeInfo(use = Id.CLASS) or Id.MINIMAL_CLASS with a default Jackson 3.x JsonMapper (the default DefaultBaseTypeLimitingValidator case needs NO application-authored validator); configured default typing in Jackson 2.x or 3.x; an allowIfBaseType(...) rule approving an outer type such as Map; or exposed integrations including Spring Data Redis 4.0.7 RedisSerializer.json()/GenericJackson2JsonRedisSerializer() and Spring Security's legacy Jackson 2 module. For the demonstrated full RCE the attacker additionally needs Spring on the classpath plus XML loadable by the application account (reaching FileSystemXmlApplicationContext → ProcessBuilder.start()); stock-JDK gadgets otherwise permit file creation/truncation, descriptor consumption, or URL requests. LIMITING FACTORS: no user interaction is required and no authentication is indicated by the CVSS vector (PR:N), but exploitation is gated on the specific polymorphism configuration, the gadget classes present on the classpath, and a reachable deserialization entry point. Versions before 2.10.0 are NOT affected because PolymorphicTypeValidator did not yet exist. Applied CVE-2026-54512 fixes (2.18.8, 2.21.4, 3.1.4) do NOT remediate this bypass.

This is a genuine high-priority issue, not a CVSS-inflated one. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is corroborated by the vuln.today Decision label 'act_now', vendor-confirmed patches across five release branches, and a detailed GHSA advisory (GHSA-m8xf-2cr7-77ph) describing working reproduction against unmodified released artifacts (2.10.0, 2.19.2, 2.22.3, 3.0.0, 3.1.5, 3.2.3). The signals are mutually reinforcing rather than conflicting: deserialization RCE (CWE-502) in a near-universally deployed Java library warrants urgent remediation. Two caveats temper the raw score. First, this is an INCOMPLETE FIX for CVE-2026-54512 - organizations that applied the earlier fixed releases (2.18.8, 2.21.4, 3.1.4) are still exposed via the remaining generic-argument and array-element paths. Second, real-world exploitability is conditional: the application must expose a class-name polymorphic deserialization path over attacker-controlled input and have a usable gadget on the classpath, so the network/low-complexity base metrics overstate the number of installations actually reachable without specific configuration. No CISA KEV listing and no EPSS score were provided in the input; absence of a KEV entry means active exploitation is NOT confirmed. A public PoC reference (standalone reproducer) is attached to the advisory but is not stated by the input to be verified working weaponized exploit code.

An unauthenticated attacker submits crafted JSON to a network-facing endpoint whose application deserializes polymorphic data (e.g., @JsonTypeInfo(use=Id.CLASS) or configured default typing) using an affected jackson-databind. Instead of a directly-blocked gadget type ID, the attacker names a permitted generic wrapper (such as Env<Gadget> or HashMap<FileSystemXmlApplicationContext,String>) so the gadget slips through validation as a generic argument; with Spring on the classpath and attacker-loadable XML this reaches ProcessBuilder.start() for command execution under the application account. A standalone reproducer is referenced in the GHSA advisory, though the input does not confirm it as verified working exploit code.