CVE-2026-83557

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to control object creation by exploiting an incomplete list of restricted types in the DefaultBaseTypeLimitingValidator. By crafting malicious input, an attacker can cause the application to create arbitrary file objects, potentially leading to path traversal if these objects are then used in sensitive operations.

Rated Moderate, not Critical or Important: exploiting this flaw needs an application to type a @JsonTypeInfo property as java.lang.Comparable without configuring its own PolymorphicTypeValidator, an uncommon pattern, which is why the vector shows High attack complexity (AC:H) rather than Low. Even under those conditions, the demonstrated attack only instantiates an attacker-chosen Comparable class such as java.io.File. No known Comparable class enables code execution through deserialization alone, and global default typing (activateDefaultTyping) isn't affected since it always requires an explicit validator. Confidentiality, integrity, and availability impact are each rated Low (C:L/I:L/A:L) because real impact, such as path traversal, requires the application to perform path-sensitive operations on the deserialized value afterward; Jackson itself doesn't do this. Most Red Hat products consume jackson-databind as a transitive dependency rather than exposing attacker-controlled Comparable-typed polymorphic properties directly, making the vulnerable pattern uncommon in practice.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If immediate upgrade is not possible, audit for @JsonTypeInfo properties typed as java.lang.Comparable without a custom PolymorphicTypeValidator. Narrow the type or add a validator that denies java.io.File and similar Comparable implementations. This doesn't apply to global default typing (activateDefaultTyping), which already requires an explicit validator.