Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.6

Unsafe data type handling in Hive, Trino, WSO2, Spark, Elasticsearch

published 28 days ago
Summary

These products automatically apply a generic type checker when they read JSON that includes type information, unless a custom check is set up. This can let specially crafted data trigger unexpected code paths, potentially exposing data or allowing unauthorized actions. Update to the latest releases that include the fix, or configure a custom type validator for JSON processing.

What to do
  • Update cleanstart apache-hive to version 3.1.3-r4.
  • Update cleanstart trino to version 481-r7.
  • Update cleanstart wso2mi to version 4.6.0-r4.
  • Update cleanstart spark-sc213-jdk17-py312 to version 4.2.0-r3.
  • Update cleanstart elasticsearch to version 9.4.5-r1.
  • Update cleanstart apache-nifi-registry to version 2.9.0-r6.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart apache-hive < 3.1.3-r4
Fix: upgrade to 3.1.3-r4
CleanStart cleanstart trino < 481-r7
Fix: upgrade to 481-r7
CleanStart cleanstart wso2mi < 4.6.0-r4
Fix: upgrade to 4.6.0-r4
CleanStart cleanstart spark-sc213-jdk17-py312 < 4.2.0-r3
Fix: upgrade to 4.2.0-r3
CleanStart cleanstart elasticsearch < 9.4.5-r1
Fix: upgrade to 9.4.5-r1
CleanStart cleanstart apache-nifi-registry < 2.9.0-r6
Fix: upgrade to 2.9.0-r6
Original advisory text
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
CVE-2026-83557 affects multiple packages. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.6 Medium
Timeline
Published8 Oct 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
CLEANSTART-2026-BM20814 · OSV
Track software like this
Free during beta