CVE-2026-83557

Affected versions of the `com.fasterxml.jackson.core:jackson-databind` package are vulnerable to Deserialization of Untrusted Data due to an incomplete denylist in the default polymorphic type validator. The `DefaultBaseTypeLimitingValidator`, which is automatically applied when `@JsonTypeInfo` is used without a specified `PolymorphicTypeValidator`, fails to deny polymorphic resolution for the `java.lang.Comparable` type, allowing its `isSafeSubType` method to return true for subtypes of this widely implemented interface. An attacker who controls the type identifier of a `Comparable`-typed property annotated with `@JsonTypeInfo` can exploit this vulnerability to instantiate any class implementing `Comparable`, such as constructing a `java.io.File` object, enabling potential path traversal attacks when the application invokes path-sensitive methods on the object.