CVE-2026-110879 | CVSS: 9.8 | 严重级别: CRITICAL
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix.
DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the type ID to _validateTypeParameter(), which validates the argument against the outer base type rather th
参考链接:
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7
• https://www.cve.org/CVERecord?id=CVE-2026-54512
📌 数据来源: NVD 官方