The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever     @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution     only for a fixed set of unsafe base types, and its isSafeSubType method returns true unconditionally for     every base type outside that set. java.lang.Comparable was absent from the list despite being implemented     by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable,     which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or     class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type     identifier for essentially any class implementing Comparable. This yields an attacker-controlled object     instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen     path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods     on the value. No class implementing Comparable has been identified that yields code execution through     deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that     method structurally requires an explicit PolymorphicTypeValidator argument. This affects     com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and     from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0     before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. (CVE-2026-83557)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-83557

medium Nessus Plugin ID 342383

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.1

Version 1.7 Sep 10, 2026, 3:20 PM CVSS metrics ("CVSSv2 score" set to 5.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P") Plugin Feed: 202609101520
Version 1.6 Sep 10, 2026, 1:56 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609100156
Version 1.5 Sep 7, 2026, 2:57 PM CVSS metrics ("CVSSv2 score" set to 5.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P") Plugin Feed: 202609071457
Version 1.4 Sep 4, 2026, 7:34 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609040734
Version 1.3 Sep 3, 2026, 1:08 PM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609031308
Version 1.1 Sep 2, 2026, 11:39 PM New Plugin Feed: 202609022339