CLEANSTART-2026-HF71124: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...
CVE-2026-110879 affects multiple packages. jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r5 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11 - Upgrade
Upgrade
cleanstart/strimzi-kafka-operatorto a version that resolves this vulnerability.Fixed in 1.2.0-r6 - Upgrade
Upgrade
cleanstart/wso2mito a version that resolves this vulnerability.Fixed in 4.6.0-r9 - Upgrade
Upgrade
cleanstart/strimzi-kafka-operatorto a version that resolves this vulnerability.Fixed in 0.51.0-r8 - Upgrade
Upgrade
cleanstart/solrto a version that resolves this vulnerability.Fixed in 9.11.0-r0
Event History
Frequently Asked Questions
Which listed products should be prioritized for assessment?
The affected software list includes cleanstart/strimzi-kafka-operator, cleanstart/wso2am, cleanstart/rundeck, cleanstart/wso2mi, and cleanstart/solr. The advisory does not provide affected version ranges for these packages.
What level of attacker access is indicated by the severity vector?
The vector indicates network-reachable exploitation with low attack complexity, no required privileges, and no user interaction. Successful exploitation is rated as having high confidentiality, integrity, and availability impact.