Your message dated Thu, 15 Oct 2026 13:07:14 +0000
with message-id <[email protected]>
and subject line Bug#1146640: fixed in jackson-databind 2.18.11-1
has caused the Debian Bug report #1146640,
regarding jackson-databind: CVE-2026-83557
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146640: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146640
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: jackson-databind
Version: 2.14.0+ds-2
Severity: important
Tags: security upstream
Forwarded: https://github.com/FasterXML/jackson-databind/issues/6156
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for jackson-databind.
CVE-2026-83557[0]:
| DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator
| applied automatically whenever @JsonTypeInfo is used without an
| explicitly configured custom validator. It denies polymorphic
| resolution only for a fixed set of "unsafe base types", and its
| isSafeSubType method returns true unconditionally for every base
| type outside that set. java.lang.Comparable was absent from the list
| despite being implemented by a very large fraction of JDK and
| application classes, comparable in breadth to java.io.Serializable,
| which is on the list for that reason. An application declaring an
| @JsonTypeInfo-annotated property or class with Comparable as its
| base type, and no custom PolymorphicTypeValidator, will accept a
| type identifier for essentially any class implementing Comparable.
| This yields an attacker-controlled object instantiation primitive; a
| demonstrated case constructs a java.io.File for an arbitrary
| attacker-chosen path, which becomes path-traversal-adjacent if the
| application subsequently calls path-sensitive methods on the value.
| No class implementing Comparable has been identified that yields
| code execution through deserialization alone. Global Default Typing
| via activateDefaultTyping is not affected, because that method
| structurally requires an explicit PolymorphicTypeValidator argument.
| This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0
| before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before
| 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before
| 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10,
| 2.21.6, 2.22.2, 3.1.6, or 3.2.2.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-83557
https://www.cve.org/CVERecord?id=CVE-2026-83557
[1]
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j
[2] https://github.com/FasterXML/jackson-databind/issues/6156
[3] https://github.com/FasterXML/jackson-databind/pull/6155
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: jackson-databind
Source-Version: 2.18.11-1
Done: Emmanuel Bourg <[email protected]>
We believe that the bug you reported is fixed in the latest version of
jackson-databind, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Bourg <[email protected]> (supplier of updated jackson-databind
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 15 Oct 2026 09:28:11 +0200
Source: jackson-databind
Architecture: source
Version: 2.18.11-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers
<[email protected]>
Changed-By: Emmanuel Bourg <[email protected]>
Closes: 1145887 1146640 1147507
Changes:
jackson-databind (2.18.11-1) unstable; urgency=medium
.
* Team upload.
* New upstream release
- Fixes CVE-2026-54512, CVE-2026-54513, CVE-2026-54514 and CVE-2026-54515
(Closes: #1145887)
- Fixes CVE-2026-83557: Comparable was missing from the unsafe base
types of DefaultBaseTypeLimitingValidator (Closes: #1146640)
- Fixes CVE-2026-68497: the XML datatype deserializers did not bound
the length of stringified numbers (Closes: #1147507)
- Updated the Maven rules
- Removed the patches, no longer needed
- Tightened the dependencies on jackson-core and jackson-annotations
* Converted debian/watch to the version 5 format
Checksums-Sha1:
ba3831fa45c2dbf1ef1667d067ed5e1ab4603a50 2427 jackson-databind_2.18.11-1.dsc
4e114dbb08c9b92c162ced5a1d7a84d7633a7bd8 1170644
jackson-databind_2.18.11.orig.tar.xz
f18d3c14478cad2d79000c1d9b4007e6c259a05d 7804
jackson-databind_2.18.11-1.debian.tar.xz
dcb098e82e26b554b2e8ead1d8f1c76d573c3cc0 20099
jackson-databind_2.18.11-1_source.buildinfo
Checksums-Sha256:
0b0c8dc995a1cf78b19a68650dab0f160608f3b420e7d8a9a9ce0a1c8724da23 2427
jackson-databind_2.18.11-1.dsc
7953119f3ebf50c226fdb8fbe88455b193584ceefb7cd9454ab1a6695d231628 1170644
jackson-databind_2.18.11.orig.tar.xz
19356d3a80146bc1b19aa6d5a5afa2e6dfb924891253cbf6de22715a54628648 7804
jackson-databind_2.18.11-1.debian.tar.xz
c4fe24ba350344e2dbfefa6442cc4978884bce9f3f9564790a0e0ab972410eb4 20099
jackson-databind_2.18.11-1_source.buildinfo
Files:
d514eb00bf94bd721b73ce68c12a6c96 2427 java optional
jackson-databind_2.18.11-1.dsc
057a642aa2a319add0ea4f864e08b321 1170644 java optional
jackson-databind_2.18.11.orig.tar.xz
108ff1d3cc42a393aa75c88aee0e9f2c 7804 java optional
jackson-databind_2.18.11-1.debian.tar.xz
a73e70765d2dbae7d6e1023de3c20547 20099 java optional
jackson-databind_2.18.11-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrQzG4SHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsDFIQAJTLxLe2bJjhQa0NS/Lj/8LOMzuGXD6x
lPmxacmX3pjqevjiK/SWuE62Q7c0hZnGDNwl2don0V7rLcHmU3R/x5LHcpMC1i6e
6tlmdPuQMgRShionp71/r649DvaCrT9c2cixTEJnwgODsEjR9Qu0+bfEz0LMS0P/
BF9eZ3KathkaPARxWCbeNTBV+6eAd3jE+GjutaAOI5B14Ne03camT3gLADXtecjf
352CVv4lNCMBB1ehzdOq5l43qjYvIiBPf7JY262pBsY17tyuu9nFuPfswowXQNky
15t30OfGrHjsY99VWa3a0CNYNKck1ilKey7UMW/tNEGw7PuW1voshi3UeDC08gO8
Mcujiw56qGHxlhciGjXJ9e7GUOA3QnVrQgorpB1Co4CoBefhQsVOfMg1NLv5nrXS
78Edig/J6NHXi5Q+8xRnBL3eYVXaioIzO2VdadNKmDEAxU3ooBX52MRQ9k31WAhn
CqtYc+TNeH5CPqWL40zaYIuSC02ni2DMmoeee8ewE5jEmyA0jrz14BBOJfP1gLnW
8fOln1h9D6IYUdDXCaOfglKAumlUP+QCcivgLogTtQx7kIooOdjmEFmf5vL0biJA
ZQ8GeY5aIaQneP0d8JPZXkWOuvAxlSfHhK8bI7e+4ssuCLwqlKP4+k4WuOwi2eMj
vL8c01hft3zz
=Ir20
-----END PGP SIGNATURE-----
pgpwBrB6bLgjo.pgp
Description: PGP signature
--- End Message ---
