FasterXML discloses critical Jackson deserialisation flaw

FasterXML has published full details and a public proof-of-concept exploit for CVE-2026-110879, a critical deserialisation flaw in jackson-databind with a CVSS v3.1 score of 9.8. Do Son, writing for SecurityOnline[.]info, notes that the vulnerability bypasses a prior fix for CVE-2026-54512 and allows an attacker to instantiate arbitrary Java classes from attacker-supplied JSON by manipulating polymorphic type handling.

The advisory states that Jackson checks the outer class in a type ID but trusts the classes nested inside it, enabling unauthenticated user control over class selection when polymorphic JSON is delivered to a network-facing deployment; with Spring present, this can lead to a process start under the application account. The official advisory includes a standalone reproducer, and the PoC is now publicly accessible.

Affected versions span jackson-databind 2.10.0 through 2.18.11, 2.19.0 through 2.21.7, and 2.22.0 through 2.22.3, with Jackson 3.x affected from 3.0.0 to 3.1.7 and 3.2.0 to 3.2.3. Security updates recommended by the advisory are jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4, and for those unable to upgrade, disabling class-name polymorphism for untrusted data or removing gadget-bearing dependencies is advised.

Do Son notes that no confirmed exploitation has yet been reported in the wild, but patches are available and should be applied promptly to mitigate risk. The article attributes the findings to FasterXML and the public advisory, with the PoC described as a public exploit aid rather than an in-the-wild compromise.