Jackson CVE-2026-83557: Deserialization RCE via java.lang.Comparable

github.com 2026-09-02 查看中文 →

Security Advisory CVE-2026-83557 High FasterXML

Affected:

FasterXML jackson-databind 2.x (with MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES enabled)
FasterXML jackson-databind 3.x (default LaissezFaireBaseTypeValidator)

Fixed in:

Referenced CVEs: CVE-2026-83557 · 5.6

文章内图片已隐藏以节省流量 · Upgrade to Pro to view images & offline archive

This content was auto-fetched from github.com, cleaned by our LLM pipeline, and translated to English. View original.