CLEANSTART-2026-FA41944: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
Published Nov 7, 2026
·Updated
Security vulnerability affects the spark-sc213-jdk17-py312 package. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator.
Affected Software
1 affected componentFixes available
cleanstart/spark-sc213-jdk17-py312<4.2.0-r9
4.2.0-r9
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/spark-sc213-jdk17-py312to a version that resolves this vulnerability.Fixed in 4.2.0-r9
Event History
Nov 7, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
When is the automatic validator selection used?
It is applied when @JsonTypeInfo is used without an explicitly configured custom validator.
2
Can an explicitly configured custom validator prevent this automatic selection?
Yes. The automatic behavior described applies only when no custom validator is explicitly configured.