CVE-2026-110879— Jackson-databind 多态验证绕过导致任意类实例化
一分钟漏洞结论
影响对象
FasterXML jackson-databind
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
jackson-databind 仅验证类名类型 ID 的外层类，却接受攻击者在其泛型参数中指定的类，即使这些类违反了声明的类型，或作为直接类型 ID 时会被拒绝。这绕过了为 CVE-2026-54512（GHSA-j3rv-43j4-c7qm）所添加的泛型参数验证机制，而当前修复并不完整。 DatabindContext._resolveAndValidateGeneric() 方法会先检查外层类是否符合声明的基类型，随后将类型 ID 中的每个参数传递给 _validateTypeParameter()。然而，该
可能的 ATT&CK 技术 1 AI
T1190 · Exploit Public-Facing Application
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-110879 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
来源: CVE Program / CVE List V5
Vulnerability Description
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix.
DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the type ID to _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing its corresponding declared generic binding. It also invokes validators with arguments that have not passed the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID. Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's base type is approved.
Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that expose that default typing. The default-validator case requires no application-authored validator: with @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as "Not a subtype", while a type ID naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied bean properties. Where class-name default typing permits Map, a property declared as Map<String,String> accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath and attacker-controlled XML the application can load, that constructor loads the XML and invokes ProcessBuilder.start() under the application account, giving arbitrary command execution.
This issue affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in jackson-databind 2.10.0.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| FasterXML | jackson-databind | 2.10.0 ~ 2.18.12 | - |
|
| FasterXML | jackson-databind | 3.0.0 ~ 3.1.8 | - |
|
二、漏洞 CVE-2026-110879 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-110879 的情报信息
请登录查看更多情报信息。
CVE-2026-110879 厂商安全公告 (1)
CVE-2026-110879 其他参考 (2)
-
-
🔗 CVE Record: CVE-2026-54512 related
同批安全公告 · FasterXML · 2026-10-28 · 共 3 条
| CVE-2026-104895 | 7.5 HIGH | jackson-dataformat-smile 异步解析器拒绝服务漏洞 |
| CVE-2026-110747 | 7.5 HIGH | Jackson 整数溢出导致内存溢出漏洞 |