Detections
Analytics
CVE-2026-68497
critical
Description
The Jackson project reports: PolymorphicTypeValidator needs to validate generic type parameters too BasicPolymorphicTypeValidator setting allowIfSubTypeIsArray() should validate element type Add java.lang.Comparable in set of "unsafe" polymorphic base types @JsonView by-passed for @JsonUnwrapped Field/Setter properties @JsonView by-passed for some "setterless" creator properties @JsonView by-passed for unwrapped creator parameters Honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties Renamed @JsonIgnore'd setters can deserialize via private fields @JsonIgnore on Record property ignored with PropertyNamingStrategy Case-insensitive deserialization may use wrong @JsonIgnoreProperties Do not allow DNS resolution when deserializing InetAddress Improve InetSocketAddress deserialization Limit the supported URL schemes for java.nio.file.Path deserialization Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration