Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.6

Apache NiFi, Gradle, Keycloak, Spark, WildFly allow unsafe deserialization

published 29 days ago
Summary

These products use a default JSON type validator that can be tricked when custom validation isn’t set, letting specially crafted data be processed in unintended ways. This could let an attacker cause the application to behave incorrectly or execute unwanted code. Update to the latest versions or configure a custom validator for JSON type handling to protect your systems.

What to do
  • Update cleanstart apache-nifi to version 2.10.0-r9.
  • Update cleanstart gradle to version 8.14.5-r2.
  • Update cleanstart keycloak to version 26.7.2-r2.
  • Update cleanstart spark to version 3.5.9-r3.
  • Update cleanstart wildfly to version 39.0.1-r9.
  • Update cleanstart wso2am to version 4.7.0-r2.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart apache-nifi < 2.10.0-r9
Fix: upgrade to 2.10.0-r9
CleanStart cleanstart gradle < 8.14.5-r2
Fix: upgrade to 8.14.5-r2
CleanStart cleanstart keycloak < 26.7.2-r2
Fix: upgrade to 26.7.2-r2
CleanStart cleanstart spark < 3.5.9-r3
Fix: upgrade to 3.5.9-r3
CleanStart cleanstart wildfly < 39.0.1-r9
Fix: upgrade to 39.0.1-r9
CleanStart cleanstart wso2am < 4.7.0-r2
Fix: upgrade to 4.7.0-r2
Original advisory text
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
CVE-2026-83557 affects multiple packages. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.6 Medium
Timeline
Published7 Oct 2026
Updated7 Oct 2026
First seen7 Oct 2026
Sources
CLEANSTART-2026-LT75275 · OSV
Track software like this
Free during beta