CVE-2026-110879 is an incomplete repair for CVE-2026-54512: Jackson databind could reject a dangerous class when it appeared directly in a JSON type identifier, yet accept it when embedded in a generic type or, in some cases, an array. That distinction matters because the embedded class is still selected by the input and can still be instantiated.
Jackson databind is the Java component that turns JSON and other supported formats into application objects, collections and trees. It is widely embedded in Java APIs, microservices and enterprise middleware, including Spring-based services. Merely having its JAR in a build is not enough for exposure: an application must have a reachable class-name polymorphic deserialization path and let an attacker influence the serialized input.
A check on the wrapper missed its contents
Polymorphic deserialization lets JSON name a concrete Java type to create. It is useful for legitimate heterogeneous data, but it needs a type validator so untrusted input cannot select arbitrary classes from the application's classpath. In the vulnerable paths, databind validated the outer type—such as a collection or map—but did not apply equivalent checks to a supplied generic argument or array element type.
That bypass affects annotation-based class-name polymorphism in Jackson 3.x, configured default typing in Jackson 2.x and 3.x, and integrations that expose default typing. A configuration rule that approved an outer base type could also cause Jackson to substitute a permissive validator for its nested type parameters. The vendor's patch preserves the configured validator instead:
- // If there's indication that any and all subtypes are fine, replace validator itself:
+ // If there's indication that any and all subtypes are fine, replace validator itself
+ // (but retain it for validating type parameters of generic type ids):
if (validity == PolymorphicTypeValidator.Validity.ALLOWED) {
- return LaissezFaireSubTypeValidator.instance;
+ return new ApprovedBaseTypeValidator(ptv);
}The practical result is arbitrary class instantiation under the application account, not an automatic guarantee of remote code execution. The advisory demonstrates file creation or truncation, outbound requests and live threads; with suitable Spring classes and attacker-controlled XML, it describes reaching ProcessBuilder.start(). Exploitability depends on configuration, a reachable input path, and useful classes being present.
Upgrade the library and remove risky type selection
Fixed releases are 2.18.12, 2.21.8, 2.22.4, 3.1.8 and 3.2.4, for their respective affected release lines. The earlier CVE-2026-54512 fixes in 2.18.8, 2.21.4 and 3.1.4 did not close this path. Older end-of-life 2.13, 2.14 and 2.15 community lines have no public upstream fixes; teams on them need a supported upgrade path or a maintained backport.
Inventory direct and transitive jackson-databind dependencies, then upgrade to the applicable fixed version. More importantly, find uses of @JsonTypeInfo(use = Id.CLASS) and default typing, remove them from untrusted request paths where possible, and constrain type allowlists to the smallest necessary set. Test real payload routes, not just dependency scans.
A vendor-published reproducer exists, but no evidence of weaponized public exploit tooling or in-the-wild attacks had surfaced as of November 1, 2026; it was also not KEV-listed at that point. For Java teams in sectors running public APIs, identity systems, integration platforms or Kafka and application-server stacks, this is a configuration-and-classpath review as much as a patching job. SecAlerts monitors an organisation's actual software stack and alerts on new vulnerabilities affecting the products it runs.
