{"id":"CVE-2026-54513","aliases":["GHSA-rmj7-2vxq-3g9f"],"url":"https://o3.security/vulnerability/CVE-2026-54513","summary":"jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)","details":"## Summary\n`BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without validating the array's component (element) type against the configured allowlist. A PTV built with `allowIfSubTypeIsArray()` plus an explicit concrete-type allowlist therefore still permits `EvilType[]` even though `EvilType` is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist.\n\n## Impact\nApplications using `BasicPolymorphicTypeValidator` with `allowIfSubTypeIsArray()` as a safeguard get no protection for concrete array component types; an attacker controlling JSON can instantiate non-allowlisted types via an array wrapper, re-opening the gadget-instantiation risk PTV is meant to prevent.\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.18 line: `>= 2.10.0, < 2.18.8` -> fixed in **2.18.8**\n- 2.19-2.21 line: `>= 2.19.0, < 2.21.4` -> fixed in **2.21.4**\n- 3.x line: `>= 3.0.0, < 3.1.4` -> fixed in **3.1.4**\n\n`PolymorphicTypeValidator` was added in 2.10.0 so vulnerability N/A for versions prior to that.\n\n## Severity / CWE\nMaintainer: significant. Reporter: HIGH. CWE-184 (Incomplete List of Disallowed Inputs); related CWE-502.\n\n## Upstream fix\nFasterXML/jackson-databind#5981; fix PR #5983 (`24529da`), 2.18 backport PR #5984 (`01d1692`). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","published":"2026-06-23T20:53:52.543Z","modified":"2026-09-16T08:11:41.456681Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00892,"percentile":0.57511,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","fixedVersion":"2.18.8"},{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","fixedVersion":"2.21.4"},{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","fixedVersion":"3.1.4"},{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","fixedVersion":"3.1.4"}],"fix":{"url":"https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","label":"FasterXML/jackson-databind@01d1692"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36839"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40895"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43218"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43400"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44061"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44062"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44063"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44064"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44065"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44066"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44271"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48095"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50846"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50847"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50848"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50849"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54622"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-54513"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54513.json"},{"type":"ADVISORY","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492010"},{"type":"REPORT","url":"https://github.com/FasterXML/jackson-databind/issues/5981"},{"type":"REPORT","url":"https://github.com/FasterXML/jackson-databind/issues/5983"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/pull/5984"},{"type":"PACKAGE","url":"https://github.com/FasterXML/jackson-databind"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-16T08:11:41.456681Z"}}