CLEANSTART-2026-LG95737: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade cleanstart/trino to a version that resolves this vulnerability.

   Fixed in 484-r1
2. Upgrade

   Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.

   Fixed in 4.3.0-r0
3. Upgrade

   Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.

   Fixed in 4.4.0-r0
4. Upgrade

   Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.

   Fixed in 4.5.0-r0
5. Upgrade

   Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.

   Fixed in 26.8.0.126808-r6
6. Upgrade

   Upgrade cleanstart/spark-sc213-jdk17-py312 to a version that resolves this vulnerability.

   Fixed in 4.2.0-r8
7. Upgrade

   Upgrade cleanstart/kafka to a version that resolves this vulnerability.

   Fixed in 4.1.2-r6
8. Upgrade

   Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.

   Fixed in 26.7.0.124771-r11
9. Upgrade

   Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.

   Fixed in 9.2.8-r11
10. Upgrade

    Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.

    Fixed in 9.5.5-r2
11. Upgrade

    Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.

    Fixed in 9.5.5-r3
12. Upgrade

    Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.

    Fixed in 9.3.8-r16

Event History

Child vulnerabilities

Contains the following vulnerabilities.

• CVE-2026-110879