Kapil Shewate created CASSANDRA-21717:
-----------------------------------------
Summary: CVE-2026-54512.jackson-databind contains the
general-purpose data-binding functionality and tree-model for Jackson Data
Processor.
Key: CASSANDRA-21717
URL: https://issues.apache.org/jira/browse/CASSANDRA-21717
Project: Apache Cassandra
Issue Type: Bug
Reporter: Kapil Shewate
CVEID: CVE-2026-54512
Description: jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. From 2.10.0 until
2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is
the primary safety mechanism guarding polymorphic deserialization. When
polymorphic typing is enabled and a type identifier contains generic parameters
(i.e. the type ID string contains <),
DatabindContext._resolveAndValidateGeneric() validates only the raw container
class name (the substring before <) against the configured PTV. If the
container type is approved, the method parses the full canonical type string
via TypeFactory.constructFromCanonical() and returns the fully parameterized
type without ever validating the nested type arguments against the PTV. The
nested type arguments are then resolved, instantiated, and populated as beans
during deserialization. An attacker who controls the type ID can therefore
place a denied class as a generic type parameter of an allowed container — for
example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is
allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via
Class.forName(name, true, loader), instantiated, and its properties are set
from attacker-controlled JSON. This completely bypasses an explicitly
configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and
3.1.4.
CWE: CWE-184: Incomplete List of Disallowed Inputs
CVSS Source: [email protected]
CVSS Base Score: 8.1
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
