rewindex

RewindexCVEs

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

High · CVSS 8.1 (CVSS 3.1)EPSS 1.2%, 69th percentilePublished Updated Assigner: GitHub_M

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-184

Tracked companies

ConfluenceJira

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

FasterXML: jackson-databindRed Hat: OpenShift Developer Tools and ServicesRed Hat: Red Hat AI Inference ServerRed Hat: Red Hat AMQ Broker 7.13.6Red Hat: Red Hat AMQ Broker 7.14.1Red Hat: Red Hat AMQ ClientsRed Hat: Red Hat Ansible Automation Platform 2Red Hat: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16Red Hat: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33Red Hat: Red Hat build of Apache Camel 4 for Quarkus 3Red Hat: Red Hat build of Apache Camel - HawtIO 4Red Hat: Red Hat build of Apicurio Registry 3Red Hat: Red Hat build of Debezium 3Red Hat: Red Hat build of Keycloak 26.4.14Red Hat: Red Hat build of Keycloak 26.6.5Red Hat: Red Hat Certificate System 10.8 for RHEL-8Red Hat: Red Hat Data Grid 8.6.2Red Hat: Red Hat Enterprise Linux 8Red Hat: Red Hat Enterprise Linux 9Red Hat: Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat: Red Hat JBoss Enterprise Application Platform 7Red Hat: Red Hat JBoss Enterprise Application Platform 8Red Hat: Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat: Red Hat Lightspeed for Runtimes OperatorRed Hat: Red Hat Offline Knowledge PortalRed Hat: Red Hat OpenShift AI (RHOAI)Red Hat: streams for Apache Kafka 2Red Hat: Streams for Apache Kafka 3.2.1

References

All CVEsMarkdownJSON