Unsafe polymorphic deserialization in Jackson Databind HikariDataSource

An unauthenticated attacker able to submit crafted JSON to a reachable vulnerable deserialization path may cause instantiation of attacker-selected classes. When a viable gadget chain is available, exploitation can result in arbitrary code execution in the security context of the affected Java application.

Do not enable global default typing for untrusted input, including ObjectMapper.enableDefaultTyping(). Avoid unsafe polymorphic type configurations using JsonTypeInfo.Id.CLASS or JsonTypeInfo.Id.MINIMAL_CLASS on attacker-controlled data. Prefer narrowly scoped, explicit type metadata using @JsonTypeInfo where polymorphism is necessary, and remove HikariCP from the runtime classpath where it is not required.

Upgrade Jackson Databind to a fixed release: 2.9.10 or later for the 2.9 branch, 2.8.11.5 or later for the 2.8 branch, or 2.6.7.3 or later for the 2.6 branch. Apply applicable vendor product updates when Jackson Databind is bundled or managed transitively.