Skip to content
OpenAdvisories
High ALAS2023-2026-3387 1 CVE

Important: jackson-databind security update (Amazon Linux 2023)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-110879: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) [CVE-2026-110879]

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 jackson-databind 0:2.21.8-1.amzn2023.0.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-110879

    jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

    jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argumen…

    FasterXML jackson-databind jackson-databind jackson-databind Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-110879.html