DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3208 advisory.

    jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without     restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from     untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws     FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls     provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted     JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a     default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in     providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs;
    further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects     com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from     2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0     before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path     from untrusted JSON should be avoided regardless of version. (CVE-2026-19032)

    DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever     @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution     only for a fixed set of unsafe base types, and its isSafeSubType method returns true unconditionally for     every base type outside that set. java.lang.Comparable was absent from the list despite being implemented     by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable,     which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or     class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type     identifier for essentially any class implementing Comparable. This yields an attacker-controlled object     instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen     path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods     on the value. No class implementing Comparable has been identified that yields code execution through     deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that     method structurally requires an explicit PolymorphicTypeValidator argument. This affects     com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and     from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0     before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. (CVE-2026-83557)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22034-1 advisory.

    - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time     Issues       (bsc#1273856).
    - CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without     restricting the URI       scheme (bsc#1277883).
    - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
    - CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes     (bsc#1280125).
    - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
    - CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable`     deserialization       (bsc#1278008).
    - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
    - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which     allows for       unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed     (bsc#1282505).
    - CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the     raw, attacker-       supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).
    - CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan     of the pending-       reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization       (bsc#1282492).

    Changes for jackson-annotations:

    - Update to 2.18.11

    Changes for jackson-core:

    - Update to 2.18.11
     * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,      CVE-2026-89407)
     * #1698: UTF8DataInputJsonParser does not honor      maxErrorTokenLength when reporting an unrecognized token      (bsc#1282505, CVE-2026-89425)
     * #1642: Fix maxDocumentLength bypass in async parser      single-feedInput() case [GHSA-2c4j-63jj-9fqr]
     * #1643: Enforce maxNameLength incrementally in      ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)      of async parser (bsc#1273857, CVE-2026-68494)      non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

    Changes for jackson-databind:

    - Update to 2.18.11
     * #6185: Bracket unresolved IPv6 host name in InetSocketAddress      serialization
     * #6203: Prevent unbounded growth of type id cache in      TypeDeserializer (bsc#1282491, CVE-2026-91776)
     * #6204: Avoid quadratic forward-reference resolution in      Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
     * #6099: Resolve classes without initialization in      TypeFactory.findClass()
     * #6116: Reject non-ASCII digits in InetAddress literal validation
     * #6127: Add StreamReadConstraints number len constraint to      javax.xml.datatype.XMLGregorianCalendar and      javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
     * #6129: Limit the supported URL schemes for java.nio.file.Path      deserialization (bsc#1277883, CVE-2026-19032)
     * #6156: Add java.lang.Comparable in set of unsafe polymorphic      base types (bsc#1278008, CVE-2026-83557)
     * #6165: Apply number length limits to BigDecimal/BigInteger/      /Double/Float Map keys

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever
    @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution
    only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for
    every base type outside that set. java.lang.Comparable was absent from the list despite being implemented
    by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable,
    which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or
    class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type
    identifier for essentially any class implementing Comparable. This yields an attacker-controlled object
    instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen
    path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods
    on the value. No class implementing Comparable has been identified that yields code execution through
    deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that
    method structurally requires an explicit PolymorphicTypeValidator argument. This affects
    com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and
    from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0
    before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. (CVE-2026-83557)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4394-1 advisory.

    - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time     Issues       (bsc#1273856).
    - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
    - CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).
    - CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).
    - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
    - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
    - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which     allows for       unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed     (bsc#1282505).

    Changes for jackson-annotations:

    - Update to 2.18.11

    Changes for jackson-bom:

    - Update to 2.18.11

    Changes for jackson-core:

    - Update to 2.18.11
     * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,      CVE-2026-89407)
     * #1698: UTF8DataInputJsonParser does not honor      maxErrorTokenLength when reporting an unrecognized token      (bsc#1282505, CVE-2026-89425)
     * #1642: Fix maxDocumentLength bypass in async parser      single-feedInput() case [GHSA-2c4j-63jj-9fqr]
     * #1643: Enforce maxNameLength incrementally in      ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)      of async parser (bsc#1273857, CVE-2026-68494)      non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

    Changes for jackson-databind:

    - Update to 2.18.11
     * #6185: Bracket unresolved IPv6 host name in InetSocketAddress      serialization
     * #6203: Prevent unbounded growth of type id cache in      TypeDeserializer (bsc#1282491, CVE-2026-91776)
     * #6204: Avoid quadratic forward-reference resolution in      Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
     * #6099: Resolve classes without initialization in      TypeFactory.findClass()
     * #6116: Reject non-ASCII digits in InetAddress literal validation
     * #6127: Add StreamReadConstraints number len constraint to      javax.xml.datatype.XMLGregorianCalendar and      javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
     * #6129: Limit the supported URL schemes for java.nio.file.Path      deserialization (bsc#1277883, CVE-2026-19032)
     * #6156: Add java.lang.Comparable in set of unsafe polymorphic      base types (bsc#1278008, CVE-2026-83557)
     * #6165: Apply number length limits to BigDecimal/BigInteger/      /Double/Float Map keys

    Changes for jackson-dataformat-xml:

    - Update to 2.18.11
     * Fix build to avoid past-JDK-8 bytecode generation
     * #891: Enforce StreamReadConstraints.maxNestingDepth in      FromXmlParser

    Changes for jackson-dataformats-binary:

    - Update to 2.18.11
     * #783: (protobuf) Support StreamReadConstraints.maxDocumentLength      in ProtobufParser
     * #785: (avro) Support StreamReadConstraints.maxDocumentLength and      maxTokenCount in Avro parser
     * #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion      parser (partial fix for #358)
     * #805: (ion) Support StreamReadConstraints.maxDocumentLength in      Ion parser (partial fix for #358)
     * #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser      (bsc#1282639, CVE-2026-68495)
     * #726: (smile) Ensure maxNameLength limit enforced for Smile      parser (bsc#1282640, CVE-2026-68496)
     * #727: (cbor) CBORParser.nextFieldName(SerializableString)      confuses 5-bit length marker 23 with 24 ('1-byte length suffix      follows')
     * #728: (cbor) CBORParser.nextFieldName(SerializableString)      consumes Object entry slot twice on fast-path miss, truncating      definite-length Objects
     * #733: (cbor) Long `String`s not added to 'stringref' reference      table, breaking following references
     * #735: (cbor) 'stringref' property-name paths pass 5-bit length      marker instead of actual length to shouldReferenceString()
     * #736: (cbor) Long Object property names added to 'stringref'      reference table twice

    Changes for jackson-modules-base:

    - Update to 2.18.11

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever     @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution     only for a fixed set of unsafe base types, and its isSafeSubType method returns true unconditionally for     every base type outside that set. java.lang.Comparable was absent from the list despite being implemented     by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable,     which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or     class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type     identifier for essentially any class implementing Comparable. This yields an attacker-controlled object     instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen     path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods     on the value. No class implementing Comparable has been identified that yields code execution through     deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that     method structurally requires an explicit PolymorphicTypeValidator argument. This affects     com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and     from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0     before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. (CVE-2026-83557)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365179	Amazon Linux 2023 : jackson-databind (ALAS2023-2026-3208)	Nessus	Amazon Linux Local Security Checks	Local	medium
364341	openSUSE 16: jackson-annotations / jackson-annotations-javadoc / jackson-core / etc (openSUSE-SU-2026:22034-1)	Nessus	SuSE Local Security Checks	Local	high
457568	Echo: com.fasterxml.jackson.core:jackson-databind: security update to 2.18.10tools.jackson.core:jackson-databind: security update to 3.1.6	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457568	Echo: com.fasterxml.jackson.core:jackson-databind: security update to 2.18.10tools.jackson.core:jackson-databind: security update to 3.1.6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
351412	SUSE SLED15: jackson-annotations / jackson-core / jackson-databind / etc (SUSE-SU-2026:4394-1)	Nessus	SuSE Local Security Checks	Local	high
448456	SCA: security update for com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind (GHSA-gx83-3vf8-gh7j)	Tenable Cloud Security	SCA Checks	Local	medium
448456	SCA: security update for com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind (GHSA-gx83-3vf8-gh7j)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
342383	Linux Distros Unpatched Vulnerability : CVE-2026-83557	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-83557

medium

Tenable Plugins

medium

high

medium

medium

high

medium

medium

medium