jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the type ID to _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing its corresponding declared generic binding. It also invokes validators with arguments that have not passed the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID. Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's base type is approved. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that expose that default typing. The default-validator case requires no application-authored validator: with @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as "Not a subtype", while a type ID naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied bean properties. Where class-name default typing permits Map, a property declared as Map<String,String> accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath and attacker-controlled XML the application can load, that constructor loads the XML and invokes ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in jackson-databind 2.10.0.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3387 advisory.

    PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind     allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) [CVE-2026-110879]     (CVE-2026-110879)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793886324 advisory.

  - jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes     inside its generic arguments, even when those classes violate the declared type or would be rejected as     direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512     (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric()     checks the outer class against the declared base type and then passes each argument from the type ID to
    _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing     its corresponding declared generic binding. It also invokes validators with arguments that have not passed     the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts     an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID.
    Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes     LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The     element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's     base type is approved. Affected paths include annotation-based class-name polymorphism with a default     Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that     expose that default typing. The default-validator case requires no application-authored validator: with     @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as Not a subtype, while a type ID     naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied     bean properties. Where class-name default typing permits Map, a property declared as Map<String,String>     accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-     controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath     and attacker-controlled XML the application can load, that constructor loads the XML and invokes     ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue     affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind     from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in     jackson-databind 2.10.0. (CVE-2026-110879)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793886324 advisory.

  - jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes     inside its generic arguments, even when those classes violate the declared type or would be rejected as     direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512     (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric()     checks the outer class against the declared base type and then passes each argument from the type ID to
    _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing     its corresponding declared generic binding. It also invokes validators with arguments that have not passed     the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts     an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID.
    Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes     LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The     element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's     base type is approved. Affected paths include annotation-based class-name polymorphism with a default     Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that     expose that default typing. The default-validator case requires no application-authored validator: with     @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as Not a subtype, while a type ID     naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied     bean properties. Where class-name default typing permits Map, a property declared as Map<String,String>     accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-     controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath     and attacker-controlled XML the application can load, that constructor loads the XML and invokes     ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue     affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind     from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in     jackson-databind 2.10.0. (CVE-2026-110879)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793620241 advisory.

  - jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes     inside its generic arguments, even when those classes violate the declared type or would be rejected as     direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512     (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric()     checks the outer class against the declared base type and then passes each argument from the type ID to
    _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing     its corresponding declared generic binding. It also invokes validators with arguments that have not passed     the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts     an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID.
    Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes     LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The     element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's     base type is approved. Affected paths include annotation-based class-name polymorphism with a default     Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that     expose that default typing. The default-validator case requires no application-authored validator: with     @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as Not a subtype, while a type ID     naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied     bean properties. Where class-name default typing permits Map, a property declared as Map<String,String>     accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-     controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath     and attacker-controlled XML the application can load, that constructor loads the XML and invokes     ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue     affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind     from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in     jackson-databind 2.10.0. (CVE-2026-110879)

  - TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer     under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for     example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to     the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no     configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly     supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed     10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that     repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from     request volume. Exploitation requires an application that enables name-based polymorphism with a     defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived     ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds     both the number of cached entries and the length of a cacheable type ID. (CVE-2026-91776)

  - Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a     linear scan of the pending-reference accumulator for every resolved ID. The affected paths are     CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent     implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an     identity-enabled collection or map and then defines those same IDs in reverse order, completion performs     on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly     causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class     and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference     lookup path for an equally sized control in which every reference was already resolved. The input requires     no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes     attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear     lookup with a keyed pending-reference structure. (CVE-2026-91777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes     inside its generic arguments, even when those classes violate the declared type or would be rejected as     direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512     (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric()     checks the outer class against the declared base type and then passes each argument from the type ID to
    _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing     its corresponding declared generic binding. It also invokes validators with arguments that have not passed     the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts     an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID.
    Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes     LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The     element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's     base type is approved. Affected paths include annotation-based class-name polymorphism with a default     Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that     expose that default typing. The default-validator case requires no application-authored validator: with     @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as Not a subtype, while a type ID     naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied     bean properties. Where class-name default typing permits Map, a property declared as Map<String,String>     accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-     controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath     and attacker-controlled XML the application can load, that constructor loads the XML and invokes     ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue     affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind     from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in     jackson-databind 2.10.0. (CVE-2026-110879)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8c1b47e2-cf3d-11f1-a655-3497f65b111b advisory.

    The Jackson project reports:
    Type parameters of generic type ids, and element types of array                 type ids, were not passed to the configured                 PolymorphicTypeValidator, so a deny-listed type could be reached                 through a type parameter.
    They are now validated like direct type ids. Approval by base                 type only covers subtypes of that base type, allowIfSubTypeIsArray()                 no longer accepts abstract or interface element types without                 allow-listing, and approval of an array type covers its element                 type only when given as exactly that class.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
377938	Amazon Linux 2023 : jackson-databind (ALAS2023-2026-3387)	Nessus	Amazon Linux Local Security Checks	Local	critical
376519	AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1793886324)	Nessus	Alma Linux Local Security Checks	Local	critical
376511	Rocky Linux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1793886324)	Nessus	Rocky Linux Local Security Checks	Local	critical
375163	AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793620241)	Nessus	Alma Linux Local Security Checks	Local	critical
372047	Linux Distros Unpatched Vulnerability : CVE-2026-110879	Nessus	Misc.	Local	critical
370449	FreeBSD : jackson-databind -- type parameters bypass the polymorphic type validator (8c1b47e2-cf3d-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-110879

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical