Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

FasterXML/jackson-databind

              3.x @ 4b96d87
            

Fixes

CVEs

CRITICAL

Peak severity

21.1%

Coverage

Highlights

Deserialization of Untrusted Data: 61 prior fixes. Scrutinize any change in this area.

src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java: most-fixed (61 issues). Treat as high-risk during review.

87 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: A massive history of polymorphic deserialization bypasses where external attackers leverage gadget chains (such as c3p0, Apache Commons DBCP, and JNDI connection factories) to achieve remote code execution. Mitigation relies on a continuously updated denylist of illegal class names.

Auth Bypass: Deserialization paths handling unwrapped creator parameters or properties annotated with @JsonUnwrapped routinely failed to validate @JsonView restrictions, allowing attackers to populate protected properties.

Deserialization of Untrusted Data: The PolymorphicTypeValidator was bypassed via nested generic type parameters of container types and recursively wrapped array types, allowing unvalidated element types to instantiate arbitrary class gadgets.