CVE-2026-83557 is a deserialization vulnerability in FasterXML jackson-databind affecting versions from 2.11.0 up to but excluding 2.18.10, 2.19.0 up to 2.21.6, 2.22.0 up to 2.22.2, 3.0.0 up to 3.1.6, and 3.2.0 up to 3.2.2. The issue arises because the DefaultBaseTypeLimitingValidator does not include java.lang.Comparable in its unsafe base types list, allowing polymorphic deserialization of any class implementing Comparable when @JsonTypeInfo is used without a custom validator. This can lead to attacker-controlled object instantiation, such as creating a java.io.File with an attacker-chosen path. No direct code execution via deserialization alone has been identified. Global default typing with explicit validators is not affected. Users should upgrade to fixed versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 to remediate.
CVE-2026-19032 is a medium severity vulnerability in FasterXML jackson-databind that involves unsafe reflection via deserialization of java.nio.file.Path from untrusted JSON input. The vulnerability arises because the deserialization process resolves a URI scheme from attacker-controlled input and uses it to select a FileSystemProvider via Java's ServiceLoader mechanism without restricting schemes. While built-in providers do not perform network I/O or mounting, a third-party provider could potentially be triggered, leading to side effects. The issue affects multiple jackson-databind versions from 2.8.0 up to but excluding 3.2.2 in various version ranges. No direct code execution or data confidentiality impact is described, and the impact is bounded by the behavior of the selected FileSystemProvider.
CVE-2026-77310 is a Server-Side Request Forgery (SSRF) vulnerability in the jackson-databind library's deserialization of java.net.InetAddress. Unlike the previously fixed InetSocketAddress deserialization which avoids DNS resolution, the InetAddress deserialization still performs eager DNS lookups on attacker-controlled input. This can lead to DNS-based SSRF allowing out-of-band interaction or internal host enumeration via DNS queries during JSON deserialization.
CVE-2026-78050 is a critical stack-based buffer overflow vulnerability in Comfast CF-N1-S version 2.6.0.1. It affects the Web Management component, specifically the function sub_41AD7C in the /cgi-bin/mbox-config?method=SET§ion=ntp_timezone endpoint. The vulnerability arises from improper handling of the timestr/ntp_client_enabled argument, allowing remote attackers to trigger a buffer overflow. Exploit code has been publicly disclosed, but no confirmed in-the-wild exploitation is reported.
CVE-2026-77683 is a critical command injection vulnerability in Comfast CF-N1-S version 2.6.0.1. The flaw exists in the system function of the /cgi-bin/mbox-config?method=SET§ion=ntp_timezone endpoint, where manipulation of the 'timestr' argument allows remote attackers to execute arbitrary commands. Public exploit code is available, increasing the risk of exploitation.
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
CVE-2026-77022 is a critical stack-based buffer overflow vulnerability in the Comfast CF-N1-S device version 2.6.0.1. The flaw exists in the SSID Configuration component, specifically in the function sub_44B438 accessed via the /cgi-bin/mbox-config?method=SET§ion=ptest_ssid endpoint. Remote attackers can exploit this vulnerability by manipulating the ssid argument, potentially leading to severe impacts. Public exploit code has been released, increasing the risk of attacks.
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
CVE-2026-76008 is a critical stack-based buffer overflow vulnerability in Comfast CF-N1-S version 2.6.0.1. It affects the get_para_from_uri function in the /cgi-bin/mbox-config component, specifically in URI parameter parsing. The vulnerability is triggered by manipulating the width/height argument remotely, potentially allowing an attacker to execute arbitrary code or cause a denial of service.
CVE-2026-75094 is a critical OS command injection vulnerability in the COMFAST CF-N1-S device version 2.6.0.1. The flaw exists in the CGI interface component, specifically in the sub_44B438 function handling the /cgi-bin/mbox-config?method=SET§ion=ptest_ssid endpoint. An attacker can remotely exploit this by manipulating the ssid argument to execute arbitrary OS commands. Exploit code has been published, increasing the risk of exploitation.
CVE-2026-19976 is a command injection vulnerability in the COMFAST CF-N1-S device version 2.6.0.1. The flaw exists in the function sub_44A968 within the /cgi-bin/mbox-config endpoint, where manipulation of the macaddress parameter can lead to remote command execution. The vulnerability has been publicly disclosed, and exploit code may be available. The vendor has not responded to disclosure requests, and no official patch or remediation guidance is currently available. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller. As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes. The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase. Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected. Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed. This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).
CVE-2026-18401 is a medium severity vulnerability in FasterXML jackson-core affecting the asynchronous JSON parser. The async parser does not enforce the maxNumberLength constraint, allowing an attacker to submit JSON with arbitrarily long number tokens. This leads to excessive memory allocation and potential CPU exhaustion, causing denial of service. The synchronous parser is not affected as it enforces this limit correctly. No privileges or user interaction beyond submitting JSON data are required. The issue affects jackson-core versions 2.15.0 through 2.18.5, 2.19.0 through 2.21.0, and 3.0.0 through 3.0.x. Patch status is not confirmed; no official fix or remediation level is stated in the vendor advisory.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.