CVE-2026-83557: Polymorphic Deserialization Bypass in FasterXML jackson-databind via java.lang.Comparable

The FasterXML jackson-databind library provides robust framework-level capabilities for serializing and deserializing Java objects to and from JSON formats. In many enterprise applications, polymorphism is a core requirement, allowing properties to be defined using abstract classes or interface types. Jackson enables this through annotations such as @JsonTypeInfo, which instruct the deserializer to parse type metadata directly from the incoming payload and resolve it to a concrete subclass.

To prevent arbitrary class loading and the instantiation of malicious payload classes—commonly known as 'gadget' chains—Jackson utilizes a series of validators to control which subtypes can be resolved from abstract base declarations. When developers do not configure a custom class validator, Jackson invokes the DefaultBaseTypeLimitingValidator by default to enforce limits on highly generic, abstract base classes. The objective is to block incoming payloads from invoking types that expose wide, systemic interfaces.

The core of the vulnerability in CVE-2026-83557 lies in the omission of java.lang.Comparable from this default set of unsafe base types. Because Comparable is implemented by an extensive library of classes throughout both the standard Java Development Kit (JDK) and external classpaths, this omission provides an attacker with a robust primitive to trigger arbitrary class instantiation. Unauthenticated remote attackers can leverage this bypass to construct custom payloads that force the application to instantiate unexpected types such as java.io.File.

Polymorphic deserialization operates by mapping JSON fields to concrete Java objects based on class names supplied inside the JSON payload. If an application declares an object property using a wide-reaching interface like java.io.Serializable or java.lang.Object, any class implementing that interface is a candidate for instantiation. To mitigate the risk of attackers instantiating arbitrary classes, Jackson employs a static denylist of unsafe base types within DefaultBaseTypeLimitingValidator.

Historically, this denylist blocked highly abstract classes and interfaces such as java.lang.Object, java.io.Serializable, java.lang.AutoCloseable, and java.lang.Cloneable. However, java.lang.Comparable was omitted from this blocklist. Because countless standard classes—including files, paths, and URI representations—implement Comparable, treating this interface as a safe base type allows attackers to bypass the validator's structural checks.

When a polymorphic field is typed as java.lang.Comparable and serialized without a custom validator, the library processes the class resolution. Since java.lang.Comparable is not evaluated as an unsafe base type, DefaultBaseTypeLimitingValidator.isSafeSubType() accepts the user-supplied subtype class name, as long as that subtype itself is not on a specific blocked list. This architectural omission directly exposes the application to unauthenticated object instantiation.

The vulnerability was resolved by directly patching DefaultBaseTypeLimitingValidator.java to include java.lang.Comparable in the UnsafeBaseTypes list. In the vulnerable versions, the static initializer block of UnsafeBaseTypes declared several core JDK classes as unsafe but left Comparable out. Below is an abstract view of the vulnerability remediation:

// Vulnerable Code: DefaultBaseTypeLimitingValidator.java
private final static class UnsafeBaseTypes {
    static {
        Set<String> s = new HashSet<>();
        s.add(Object.class.getName());
        s.add(java.io.Serializable.class.getName());
        s.add(AutoCloseable.class.getName());
        s.add(Cloneable.class.getName());
        // Missing java.lang.Comparable
        UNSAFE = s;
    }
}

To resolve this issue, the maintainers explicitly added Comparable.class.getName() to the UNSAFE set in commit eb3b7fc0f9c0d27f471550ac3316b17d1987388f. The patched implementation prevents polymorphic resolution when the declared field type is a standard Comparable interface:

// Patched Code: DefaultBaseTypeLimitingValidator.java
private final static class UnsafeBaseTypes {
    static {
        Set<String> s = new HashSet<>();
        s.add(Object.class.getName());
        s.add(java.io.Serializable.class.getName());
        s.add(AutoCloseable.class.getName());
        s.add(Cloneable.class.getName());
        // [databind#6156]: "Comparable" added as well
        s.add(Comparable.class.getName());
        UNSAFE = s;
    }
}

Additionally, the unit tests inside AnnotatedPolymorphicValidationTest.java were expanded to assert that attempts to deserialize payloads targeting Comparable properties will fail by default with an InvalidDefinitionException. Developers who explicitly require polymorphic handling of Comparable must now implement a custom validator subclass and override isUnsafeBaseType() alongside strict validation of safe subtypes within isSafeSubType().

To successfully exploit CVE-2026-83557, the target application must expose a deserialization endpoint that accepts JSON data bound to a Java class containing a property of type java.lang.Comparable (or a subtype), decorated with polymorphic typing annotations like @JsonTypeInfo.

An attacker can craft a payload containing a class identifier such as java.io.File inside the polymorphic type array, followed by the path argument. When the payload is processed, the validator allows the class loading, resulting in the instant creation of the java.io.File object mapping to the attacker's designated target:

{
  "value": ["java.io.File", "/etc/passwd"]
}

While this instantiation does not immediately execute code on the system, the danger arises from the subsequent lifecycle of the deserialized object. If the application invokes file-related operations, comparisons, or path validation routines on the instantiated Comparable property, the attacker can leverage the primitive to execute path traversal attacks, local file read validations, or state manipulation within the business logic.

The vulnerability carries a CVSS v3.1 base score of 5.6, reflecting a 'Medium' severity profile. The vector breakdown CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L illustrates that while the attack can be launched remotely without privileges, its execution complexity is high because it requires target properties to use highly specific polymorphic typing parameters.

The potential impact is highly contingent on the application's runtime environment and classpath. If the classpath contains complex classes implementing Comparable that execute side effects during construction or setter execution, the security impact could escalate. Furthermore, being able to arbitrarily instantiate classes like java.io.File allows attackers to interact with internal filesystem state depending on how the deserialized object is handled.

From a secure coding perspective, this vulnerability highlights the structural fragility of relying on denylists or blocklists to secure deserialization frameworks. Any omission of wide-ranging classes or interfaces in the library's built-in validation mechanism can expose application endpoints to unexpected behaviors, underlining the necessity of strict allowlisting strategies.

The primary remediation path for CVE-2026-83557 is upgrading jackson-databind to a fully patched version. Organizations utilizing the Jackson 2.x ecosystem must upgrade to 2.18.10, 2.21.6, or 2.22.2 depending on their release line. Organizations transitioning to Jackson 3.x must migrate to 3.1.6 or 3.2.2 to ensure the validator blocks the Comparable base type.

If upgrading the library is not immediately feasible, developers can mitigate the risk by refactoring vulnerable class models. Properties should not be typed with extremely generic interfaces like java.lang.Comparable under polymorphic configurations. Instead, define strict, domain-specific base classes or interfaces to restrict the possible space of candidate subtypes.

Additionally, developers can configure an explicit allowlist-based validation model utilizing BasicPolymorphicTypeValidator. By manually defining which base types and subtypes are permitted to resolve, applications can isolate their deserialization endpoints and insulate themselves against potential omissions in the default library validator.