🛡️ CVE-2026-54513 — jackson-databind
Description
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Summary
BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist.
Impact
Applications using BasicPolymorphicTypeValidator with allowIfSubTypeIsArray() as a safeguard get no protection for concrete array component types; an attacker controlling JSON can instantiate non-allowlisted types via an array wrapper, re-opening the gadget-instantiation risk PTV is meant to prevent.
Affected / Patched (verified via git tag --contains)
- 2.18 line:
>= 2.10.0, < 2.18.8-> fixed in 2.18.8 - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4
PolymorphicTypeValidator was added in 2.10.0 so vulnerability N/A for versions prior to that.
Severity / CWE
Maintainer: significant. Reporter: HIGH. CWE-184 (Incomplete List of Disallowed Inputs); related CWE-502.
Upstream fix
FasterXML/jackson-databind#5981; fix PR #5983 (24529da), 2.18 backport PR #5984 (01d1692). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
How this vulnerability can be exploited
This issue can be reached over the network, attack complexity is high, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.
Affected software
CVE-2026-54513 is recorded against 3 packages.
- com.fasterxml.jackson.core:jackson-databind (from 3.0.0 up to 3.1.4)
- jackson-databind (from 3.0.0 up to 3.1.4)
- tools.jackson.core:jackson-databind (from 3.0.0 up to 3.1.4)
Timeline and source
Published on 23 June 2026 and last revised on 6 August 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.
References
github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
security.access.redhat.com (Web)
github.com (Package)
bugzilla.redhat.com (Web)
access.redhat.com (Web)
access.redhat.com (Web)
access.redhat.com (Web)
access.redhat.com (Web)
access.redhat.com (Web)
Details
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | 3.0.0 | 3.1.4 |
| jackson-databind | 3.0.0 | 3.1.4 |
| tools.jackson.core:jackson-databind | 3.0.0 | 3.1.4 |
References
Similar Threats
- Unknown CLSA-2026-1776386160
- High CVE-2021-46877
- High CVE-2020-10650
- High CVE-2020-36518
- High CVE-2020-24616
More CVE 2026 advisories
Browse all of CVE 2026 in the advisory index.
Site Security Check
Is jackson-databind part of your stack?
CVE-2026-54513 is rated CVSS 8.1 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.