CVE-2026-110879

PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) [CVE-2026-110879]

Red Hat has evaluated this vulnerability as an Important severity flaw because successful remote exploitation can result in arbitrary class instantiation and code execution, though it requires specific non-default deserialization patterns. For an application to be vulnerable, polymorphic type validation must be configured to process untrusted input with class-name identifiers, and exploitable gadget classes must exist on the classpath. In standard Red Hat product configurations, permissive class-name polymorphism is not enabled by default on external interfaces, significantly limiting exposure in typical production environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.