A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
The following conditions are needed for an exploit, we recommend avoiding all if possible
enableDefaultTyping()
@JsonTypeInfo using
id.CLASSor
id.MINIMAL_CLASS`