CVE-2026-110879
jackson-databind polymorphic type validation bypass via nested generic and array element types - gadget deserialization, reachable RCE
- Severity
- critical
- Affected product
- jackson-databind
- Affected versions
- jackson-databind ≥ 2.10.0, ≤ 2.18.11
- Affected versions
- jackson-databind ≥ 2.19.0, ≤ 2.21.7
- Affected versions
- jackson-databind ≥ 2.22.0, ≤ 2.22.3
- Affected versions
- jackson-databind ≥ 3.0.0, ≤ 3.1.7
- Affected versions
- jackson-databind ≥ 3.2.0, ≤ 3.2.3
- Fixed in
- jackson-databind 2.18.12
- Fixed in
- jackson-databind 2.21.8
- Fixed in
- jackson-databind 2.22.4
- Fixed in
- jackson-databind 3.1.8
- Fixed in
- jackson-databind 3.2.4
- Detection basis
- Component version range
- Shipped rule
- jackson-databind: jackson-databind polymorphic type validation bypass via nested generic and array element types - gadget deserialization, reachable RCE
- Added to NewScan
- 2026-10-28
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints jackson-databind from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints jackson-databind from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints jackson-databind from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints jackson-databind from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints jackson-databind from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.