CVE-2026-83557: CWE-502 Deserialization of Untrusted Data in FasterXML jackson-databind

The vulnerability arises from the DefaultBaseTypeLimitingValidator class in jackson-databind, which restricts polymorphic deserialization for a set of unsafe base types but does not include java.lang.Comparable in this denylist. Since Comparable is widely implemented, an application using @JsonTypeInfo on a Comparable-typed property without a custom PolymorphicTypeValidator will accept any subtype implementing Comparable. This allows an attacker to craft JSON payloads that deserialize into arbitrary Comparable classes, demonstrated with java.io.File, potentially leading to unsafe object instantiation. The issue does not affect configurations using activateDefaultTyping() with an explicit custom validator. The vulnerability is confirmed in jackson-databind versions >=2.11.0 <2.18.10, >=2.19.0 <2.21.6, >=2.22.0 <2.22.2, >=3.0.0 <3.1.6, and >=3.2.0 <3.2.2.

Applications using jackson-databind with @JsonTypeInfo on Comparable-typed properties and no custom restrictive PolymorphicTypeValidator are vulnerable to polymorphic deserialization of arbitrary Comparable implementations. This can lead to unsafe object creation, such as instantiating java.io.File objects with attacker-controlled paths. The vulnerability has a CVSS 3.1 score of 5.6 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a low level. No known exploits in the wild are reported.

No official patch or remediation is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, applications should avoid using the default polymorphic type validator with @JsonTypeInfo on Comparable-typed properties without a custom restrictive PolymorphicTypeValidator. Using activateDefaultTyping() with an explicit custom PolymorphicTypeValidator that restricts allowed subtypes effectively prevents exploitation of this issue.