CVE-2026-83557: Jackson Databind Path Traversal Vulnerability

CVE-2026-83557 Overview

CVE-2026-83557 affects jackson-databind, the widely deployed Java JSON processing library from FasterXML. The DefaultBaseTypeLimitingValidator fails to include java.lang.Comparable in its list of unsafe polymorphic base types. Applications using @JsonTypeInfo with Comparable as the base type — and no custom PolymorphicTypeValidator — accept a type identifier for any class implementing Comparable. This provides attackers with an object instantiation primitive during deserialization. A demonstrated exploitation path constructs a java.io.File for an attacker-chosen path, enabling path-traversal-adjacent behavior when the application later invokes path-sensitive methods on the deserialized value. The flaw is tracked under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Attackers who control JSON input processed by vulnerable jackson-databind versions can trigger instantiation of arbitrary Comparable-implementing classes, including java.io.File, enabling path-sensitive attacks when the value is subsequently used.

Affected Products

com.fasterxml.jackson.core:jackson-databind versions 2.11.0 through 2.18.9, 2.19.0 through 2.21.5, and 2.22.0 through 2.22.1
tools.jackson.core:jackson-databind versions 3.0.0 through 3.1.5 and 3.2.0 through 3.2.1
Applications using @JsonTypeInfo with java.lang.Comparable as base type and no custom PolymorphicTypeValidator

Discovery Timeline

2026-09-01 - CVE-2026-83557 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-83557

Vulnerability Analysis

Jackson-databind supports polymorphic deserialization through the @JsonTypeInfo annotation, which embeds a type identifier in JSON payloads. To constrain which classes deserialization can instantiate, jackson-databind applies a PolymorphicTypeValidator. When no custom validator is configured, DefaultBaseTypeLimitingValidator is used automatically.

The validator maintains a deny-list of unsafe base types such as java.io.Serializable. For any base type outside this list, isSafeSubType returns true unconditionally. The maintainers omitted java.lang.Comparable from the deny-list despite its breadth: it is implemented by a large fraction of JDK and application classes, comparable in scope to Serializable.

Exploitation requires an application to declare an @JsonTypeInfo-annotated property or class with Comparable as the base type. No Comparable-implementing gadget has been identified that yields code execution through deserialization alone. Global Default Typing configured via activateDefaultTyping is not affected because that method structurally requires an explicit PolymorphicTypeValidator.

Root Cause

The root cause is an incomplete deny-list in DefaultBaseTypeLimitingValidator. The validator relies on enumerating unsafe base types rather than allow-listing safe subtypes. Omitting java.lang.Comparable leaves an over-broad polymorphic surface reachable by any application using the default validator.

Attack Vector

An attacker submits crafted JSON to an application endpoint that deserializes into a field or class annotated with @JsonTypeInfo and typed as Comparable. The payload specifies a type identifier for java.io.File (or another Comparable-implementing class) with an attacker-chosen constructor argument. When the resulting object is passed to path-sensitive APIs, the attacker gains control over the target path.

text

// Security patch entry (release-notes/VERSION-2.x)
#6156: Add `java.lang.Comparable` in set of "unsafe" polymorphic base types
  [GHSA-gx83-3vf8-gh7j]
 (reported by @prvazsahnazarov)

Source: FasterXML/jackson-databind commit eb3b7fc

Detection Methods for CVE-2026-83557

Indicators of Compromise

JSON request bodies containing type discriminator fields (for example @class, @type) referencing java.io.File or unexpected Comparable-implementing classes
Application logs showing deserialization of File instances with attacker-controlled paths outside expected working directories
File access attempts to sensitive paths such as /etc/passwd, C:\Windows\, or application configuration directories following JSON input processing

Detection Strategies

Perform static analysis of Java code for @JsonTypeInfo annotations on properties or classes typed as java.lang.Comparable without a paired @JsonTypeResolver or custom PolymorphicTypeValidator
Inspect dependency manifests (pom.xml, build.gradle) for vulnerable jackson-databind versions and flag builds below 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2
Deploy web application firewall rules that inspect JSON bodies for suspicious polymorphic type identifiers referencing JDK classes

Monitoring Recommendations

Enable verbose logging of Jackson deserialization exceptions and correlate with subsequent file-system operations
Alert on process activity where Java applications open files outside expected directory allow-lists shortly after HTTP API calls
Track SBOM changes across CI/CD pipelines to identify introduction of vulnerable jackson-databind versions

How to Mitigate CVE-2026-83557

Immediate Actions Required

Upgrade com.fasterxml.jackson.core:jackson-databind to 2.18.10, 2.21.6, or 2.22.2 depending on the current major line
Upgrade tools.jackson.core:jackson-databind to 3.1.6 or 3.2.2 for Jackson 3.x users
Audit application code for @JsonTypeInfo usage with Comparable base types and refactor to more specific base types where feasible

Patch Information

The fix adds java.lang.Comparable to the set of unsafe polymorphic base types enforced by DefaultBaseTypeLimitingValidator. Details are published in the GitHub Security Advisory GHSA-gx83-3vf8-gh7j, with the code change in pull request #6155 and the tracking issue #6156.