DefaultBaseTypeLimitingValidator, the default validator used when @JsonTypeInfo is applied but no custom validator is configured, maintains a denylist of unsafe base types and treats all other base types as safe by default. The Java type java.lang.Comparable was omitted from that denylist, allowing any class that implements Comparable to be instantiated through polymorphic deserialization. This provides an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File with an attacker‑chosen path, enabling path‑traversal or other sensitive operations. No deserialization chain for code execution has been observed, so the risk is mainly in arbitrary object creation and potential misuse rather than direct remote code execution. This vulnerability is also associated with CWE-1287, CWE-502, and CWE-915.

FasterXML’s jackson-databind is affected, covering com.fasterxml.jackson.core:jackson-databind for versions 2.11.0 up to but not including 2.18.10, 2.19.0 up to but not including 2.21.6, and 2.22.0 up to but including 2.22.2, as well as tools.jackson.core:jackson-databind for versions 3.0.0 up to but not including 3.1.6 and 3.2.0 up to but not including 3.2.2. Earlier or later versions are not impacted.

The CVSS score of 5.6 indicates moderate severity. The EPSS score is 0.00586, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation yet. Based on the description, it is inferred that if an application exposes Jackson deserialization over a network, an attacker could send JSON specifying a Comparable subtype as the desired type, leading the application to instantiate an arbitrary object. The exploit requirement is the use of default polymorphic resolution without a custom PolymorphicTypeValidator, which can be mitigated by configuring a restrictive validator or narrowing the base type. The vulnerability also involves CWE-1287, CWE-502, and CWE-915.