Details and PoC Exploit Released for Jackson-Databind Flaw CVE-2026-110879 (CVSS 9.8)

TL;DR

FasterXML has published full details and a proof-of-concept exploit for CVE-2026-110879, a critical jackson-databind vulnerability. The flaw scores 9.8 on CVSS v3.1. It bypasses the fix for an earlier bug, CVE-2026-54512, and lets attackers create arbitrary Java classes from JSON.

Jackson checks the outer class in a type ID but trusts the classes nested inside it. The public advisory includes a standalone reproducer, so the PoC exploit is now available to anyone. Upgrade to a patched jackson-databind release.

Why It Matters

Jackson is a core JSON library in the Java world, so this jackson-databind vulnerability reaches many apps. Moreover, the advisory names Spring components that expose the vulnerable path. These include Spring Data Redis and Spring Security’s legacy Jackson 2 module.

According to the advisory, “An unauthenticated attacker who controls polymorphic JSON in an affected network-facing deployment can select classes to instantiate.” With Spring present, the demonstrated chain starts a new process “under the application account.”

How the Attack Works

The advisory explains that Jackson “accepts attacker-selected classes inside its generic arguments even when they violate the declared type.” In other words, a class blocked as a direct type ID slips through when wrapped inside a generic type. Array element types had the same gap.

Notably, the fixed releases for CVE-2026-54512 still “accept the remaining path.” However, exploitation depends on the app’s polymorphism settings and the classes on its classpath. The public PoC exploit shows these effects with test resources. So far, no attacks in the wild have been confirmed.

Affected Versions

• jackson-databind 2.10.0 through 2.18.11, 2.19.0 through 2.21.7, and 2.22.0 through 2.22.3
• Jackson 3.x: 3.0.0 through 3.1.7, and 3.2.0 through 3.2.3

Patch and Mitigation

Install jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. The fix now validates “every class named in a type ID, including type parameters and array element types.”

If you cannot upgrade, disable class-name polymorphism for untrusted data. Also, remove unneeded gadget-bearing dependencies. See the jackson-databind advisory GHSA-m8xf-2cr7-77ph for every affected setup tied to this jackson-databind vulnerability.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.