Not for untrusted input. Jackson's own documentation says default typing is not generally encouraged and is recommended against when the content source is not trusted, because attackers can name classes that act as deserialization gadgets. Prefer per class type annotations and, if you must use default typing, a strict PolymorphicTypeValidator.
What default typing does
Normally JSON carries data but not Java class names. Default typing makes Jackson write, and later read, the class name for certain values. That lets one field hold different subclasses. The Jackson polymorphic deserialization documentation describes enabling it globally with a PolymorphicTypeValidator, and choosing which types are affected, such as Object, non concrete types or all non final classes.
The problem is who chooses the class. If untrusted input can name a class, Jackson may create it.
The gadget problem
Jackson's docs explain the risk: a class on the classpath may expose methods or fields that, when set through deserialization, do something harmful. These are known as deserialization gadgets. The docs say Jackson keeps a predefined block list of known cases, but that new ones are found over time, so at any moment there may be unblocked attack vectors.
That is why scanner findings in jackson-databind keep appearing. See our write ups on Jackson polymorphic deserialization issues and ObjectMapper risks.
| Approach | Exposure to attacker chosen classes |
|---|---|
| No polymorphism, concrete types only | Lowest |
| Per class JsonTypeInfo with a fixed set of subtypes | Low, you list the allowed types |
| Default typing with a tight validator | Depends on the allow list |
| Default typing with a permissive validator on untrusted input | High |
The docs say default typing can be reasonable when both ends, sender and receiver, are controlled by the same entity.
Steps
- Search for activateDefaultTyping and the older enableDefaultTyping in your code and in shared libraries.
- For each hit, ask who controls the JSON. Public request bodies, queue messages and cache entries all count.
- Replace global default typing with annotations that name allowed subtypes.
- If you keep default typing, build the validator with explicit allowed base types and packages, not a permissive setting.
- Keep jackson-databind current, and review how a transitive version is chosen. See Spring Boot managed versions.
- Use reachability analysis to separate a jackson advisory in your tree from one that your code can trigger.
Try it yourself
Click through it at your own pace, or open it full screen. Safeguard scans dependencies, produces SBOMs and uses reachability analysis to show which findings your code can actually reach. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Does upgrading jackson-databind fix this?
Upgrades add to the block list, but the docs say new gadgets are found over time. Reducing who can name classes is the lasting fix.
Is JSON itself a deserialization risk?
Plain data binding to concrete types is much lower risk than type information chosen by the sender. See our post on whether JSON is safe from deserialization attacks.
Sources
Last reviewed: 19 October 2026.
