CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-184

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Affected products

FasterXML jackson-databind: from 2.10.0 before 2.18.8; from 2.19.0 before 2.21.4; from 3.0.0 before 3.1.4 — fixed in 2.18.8, 2.21.4, 3.1.4

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.18.8, 2.21.4, 3.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-54513 or the next vulnerability affects your stack