What is deserialization?

Deserialization turns JSON text into a Java object. It rebuilds data your code can use.

Which versions are fixed?

Use 2.18.12, 2.21.8, or 2.22.4 for your release line.

ResourcesBlog

Jackson Databind 9.8 Flaw Bypasses Its Own Type Check

A new Jackson flaw scores 9.8. It bypasses a recent fix. Upgrade to a fixed build now.

Leonard EserePublished 2026-10-28Reading time 4 min

Filed underJackson deserialization flaw remediation Java evidence

Jackson Databind 9.8 Flaw Bypasses Its Own Type Check

Summary

Jackson databind has a 9.8 deserialization flaw, published October 28, 2026.
The flaw bypasses a recent fix for an earlier Jackson flaw.
Only applications with class name polymorphic typing enabled are exposed.
Fixed builds are 2.18.12, 2.21.8, and 2.22.4.

What changed today

FasterXML published a new flaw on October 28, 2026. The library is jackson-databind, a Java tool for reading JavaScript Object Notation (JSON) data. The record is CVE-2026-110879. Common Vulnerabilities and Exposures (CVE) is the record system for public flaws. The score is 9.8 under Common Vulnerability Scoring System (CVSS) version 3.1. The weakness type is Common Weakness Enumeration (CWE) 502, Deserialization of Untrusted Data.

How the bypass works

Jackson can read a class name from JSON data. That feature is called polymorphic typing. An application can allow only approved classes as type names. The new flaw breaks that check in a narrow way. Jackson checks the outer class in a type ID. It accepts attacker chosen classes inside generic arguments. It also accepts them inside array element types. Those inner classes would fail as direct type IDs. So the check passes on the outside and fails inside. This is an incomplete fix for CVE-2026-54512. The earlier flaw added generic argument validation. The new flaw bypasses that validation.

When an application is exposed

Default Jackson without polymorphic typing is not exposed by this flaw. Exposure needs an application that reads attacker controlled JSON data. That application must enable class name polymorphic typing. One path uses @JsonTypeInfo with Id.CLASS or Id.MINIMAL_CLASS. Another path is configured default typing. The declared type must also permit an approved outer type. That approved outer type can be a generic type or an array type. If those conditions are missing, this flaw does not apply.

What is not confirmed

The Cybersecurity and Infrastructure Security Agency (CISA) has not listed this flaw. No listing exists in the Known Exploited Vulnerabilities (KEV) catalog. No confirmed exploitation in the wild has been reported. No confirmed public exploit code has been reported. The case for acting now is the 9.8 score in a widely used library.

What to patch

2.10.0 to below 2.18.12: upgrade to 2.18.12.
2.19.0 to below 2.21.8: upgrade to 2.21.8.
2.22.0 to below 2.22.4: upgrade to 2.22.4.
Check the exact build after install. A version number that looks close is not proof.

The governance lesson

A 9.8 score in a shared library is a supply chain risk. One library can sit inside many applications at once. Your inventory must list every application that uses Jackson. Your inventory must list the Jackson version in each one. Record the version before and after the patch. Record the patch date and the scan result. A patch note with no version proof is a claim. FasterXML ships the fix. PolicyCortex does not patch Jackson. PolicyCortex helps teams link proof to requirements.

Sources

CVE-2026-110879 record, CVE Program. Published October 28, 2026. Score 9.8.
National Vulnerability Database (NVD) record for CVE-2026-110879.
FasterXML advisory GHSA-m8xf-2cr7-77ph. Affected and fixed versions.
CVE-2026-54512 record, CVE Program. Earlier flaw with generic argument validation.
Original diagram by PolicyCortex.

Next step

Upgrade Jackson to a fixed build, then record the version proof.

Questions on this record

What is deserialization?: Deserialization turns JSON text into a Java object. It rebuilds data your code can use.
Which versions are fixed?: Use 2.18.12, 2.21.8, or 2.22.4 for your release line.
Is default Jackson exposed?: No. Default Jackson without polymorphic typing is not exposed by this flaw.
Is exploitation confirmed?: No. The Cybersecurity and Infrastructure Security Agency (CISA) has not listed this flaw. No confirmed exploitation has been reported.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.