CVE-2026-110879 - jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
CVE ID :CVE-2026-110879 Published : Oct. 28, 2026, 1:16 a.m. | 1 hour, 7 minutes ago Description :jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would...