Search: CVE-2026-110879

CVE-2026-110879 is a critical deserialization vulnerability in FasterXML jackson-databind affecting versions from 2.10.0 up to but excluding fixed releases 2.18.12, 2.21.8, 2.22.4, 3.1.8, and 3.2.4. The flaw allows attacker-controlled classes inside generic type arguments to bypass validation, enabling deserialization of malicious objects. This can lead to arbitrary code execution, notably when combined with Spring on the classpath, allowing attackers to execute commands via crafted XML input.