jackson-databind · Disclosed

jackson-databind type validator bypassed again in CVE-2026-110879

· 1 min read

CVE-2026-110879 is an incomplete fix for CVE-2026-54512: the PolymorphicTypeValidator checks only the outer class and misses generic type arguments and array element types, letting attackers instantiate unauthorized classes. Java apps using polymorphic deserialization with this validator are exposed. Restrict accepted types until the project addresses a fix.

By Updated Get this every day →← Back to the feed 1 source
WhatsApp LinkedIn X
HighVulnerabilityDisclosedFix unconfirmed
In this article
  1. For the technical team
  2. Timeline
  3. Sources

Incidents like this, every morning

The ones that need action first, in a 3-minute read.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

For the technical team

CVE
CVE-2026-110879
Affected
jackson-databind (biblioteca Java de desserialização)
Exploitation
Disclosed
Fix
Fix unconfirmed

Timeline

  1. Incident opened.

Sources 1 source

Get the next one tomorrow morning

One email a day with what changed, what to fix first and how. After signing up you get the full feed.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Share it with your team

Whoever handles security with you should get it too.

LinkedIn X

Your colleague gets a confirmation request. Nothing is sent unless they confirm.

See all news

Read also

Before you go: get this every day

The HIFY Radar daily edition lands every morning with the incidents that need action. Free.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click