jackson-databind versions 2.10.0 through versions prior to 2.18.8, 2.21.4, and 3.1.4 contain a deserialization vulnerability due to incomplete validation of generic type parameters in polymorphic type identifiers. The PolymorphicTypeValidator (PTV) only validates the raw container class name before the generic parameter delimiter '<', allowing an attacker to embed a disallowed class as a generic parameter inside an allowed container type. This bypasses the PTV allow-list and results in the instantiation and population of attacker-controlled classes during deserialization, leading to high impact security risks. The vulnerability is addressed in jackson-databind versions 2.18.8, 2.21.4, and 3.1.4.

Successful exploitation allows an unauthenticated attacker to bypass the PolymorphicTypeValidator allow-list and cause the deserialization of arbitrary classes, potentially leading to remote code execution, complete confidentiality, integrity, and availability compromise of the affected system. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in jackson-databind versions 2.18.8, 2.21.4, and 3.1.4. Users should upgrade to one of these versions or later to remediate the issue. No official patch or temporary fix is indicated beyond upgrading. Until upgraded, avoid enabling polymorphic typing with untrusted input or restrict deserialization to trusted types only.