jackson-databind versions 2.10.0 through 2.18.7, 2.18.0 through 2.21.3, and 3.0.0 through 3.1.3 contain a vulnerability in the PolymorphicTypeValidator (PTV) mechanism. When polymorphic typing is enabled and the type identifier includes generic parameters, the validator only checks the raw container class name, ignoring nested generic type arguments. This allows an attacker controlling the type ID string to specify a denied class as a generic parameter inside an allowed container class, bypassing the PTV allow-list. The denied class is then instantiated and populated from attacker-controlled JSON, enabling potential remote code execution or other impacts. The vulnerability is addressed in jackson-databind versions 2.18.8, 2.21.4, and 3.1.4.

Successful exploitation allows an attacker to bypass the PolymorphicTypeValidator allow-list and instantiate arbitrary classes during deserialization, potentially leading to remote code execution, data corruption, or denial of service. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

This vulnerability is fixed in jackson-databind versions 2.18.8, 2.21.4, and 3.1.4. Users should upgrade to one of these versions or later to remediate the issue. No official temporary fixes or workarounds are provided. Patch status is confirmed by the vendor advisory. Users should verify upgrade paths and test accordingly.