Spotted what might be an issue in pom.xml around line 215.
The application depends on jackson-databind 2.17.1, which is vulnerable to CVE-2026-54512. The flaw allows an attacker to bypass the PolymorphicTypeValidator by embedding a malicious class as a generic type argument in a permitted container type, leading to arbitrary object instantiation and potential remote code execution during JSON deserialization. This is a HIGH‑severity issue because it can be exploited simply by sending crafted JSON to any endpoint that performs polymorphic deserialization. Upgrading to a fixed version (≥ 2.18.8, 2.21.4, or 3.1.4) mitigates the vulnerability.
Something like this might fix it:
*** Begin Patch
*** Update File: pom.xml
@@
- <dependency>
- <groupId>com.fasterxml.jackson.core</groupId>
- <artifactId>jackson-databind</artifactId>
- <version>2.17.1</version>
- </dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ <!-- Fixed CVE-2026-54512: upgrade to version with proper PolymorphicTypeValidator handling -->
+ <version>2.18.8</version>
+ </dependency>
*** End Patch
For reference: rule CVE-2026-54512. Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
pom.xmlaround line 215.The application depends on jackson-databind 2.17.1, which is vulnerable to CVE-2026-54512. The flaw allows an attacker to bypass the PolymorphicTypeValidator by embedding a malicious class as a generic type argument in a permitted container type, leading to arbitrary object instantiation and potential remote code execution during JSON deserialization. This is a HIGH‑severity issue because it can be exploited simply by sending crafted JSON to any endpoint that performs polymorphic deserialization. Upgrading to a fixed version (≥ 2.18.8, 2.21.4, or 3.1.4) mitigates the vulnerability.
Something like this might fix it:
For reference: rule
CVE-2026-54512. Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.