Detections
Analytics
CVE-2026-110879
critical
Description
The Jackson project reports: Type parameters of generic type ids, and element types of array type ids, were not passed to the configured PolymorphicTypeValidator, so a deny-listed type could be reached through a type parameter. They are now validated like direct type ids. Approval by base type only covers subtypes of that base type, allowIfSubTypeIsArray() no longer accepts abstract or interface element types without allow-listing, and approval of an array type covers its element type only when given as exactly that class.