CLEANSTART-2026-TI05927: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...
CVE-2026-110879 affects multiple packages. jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.10.0.133078-r0 - Upgrade
Upgrade
cleanstart/strimzi-kafka-operatorto a version that resolves this vulnerability.Fixed in 1.3.0-r0
Event History
Frequently Asked Questions
Which deployed components should be prioritized for review?
The advisory lists cleanstart/sonarqube and cleanstart/strimzi-kafka-operator. Review deployments of both components for their use of jackson-databind and applicable package-specific vulnerability details.
What attacker-controlled input is relevant to exploitation?
The issue involves class-name type IDs whose generic arguments can contain attacker-selected classes. Validation of the outer class alone does not prevent those classes from being accepted inside generic arguments.
Does the advisory provide affected or fixed version information?
No affected or fixed versions are included in the provided advisory data. The referenced individual vulnerability details must be consulted for package-specific version information.