PT-2026-51596 · Unknown · Jackson-Databind

Omkhar · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-54513

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.10.0 through 2.18.7 jackson-databind versions 2.19.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3

Description The BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() function allowlists any array type based solely on clazz.isArray(), failing to validate the array's component type against the configured allowlist. This allows an attacker who controls JSON input to instantiate non-allowlisted types via an array wrapper, bypassing the protections intended by the Polymorphic Type Validator (PTV) and re-introducing the risk of gadget instantiation. This occurs because when Jackson deserializes elements without per-element type IDs, it instantiates the component type directly without further PTV checks.

Recommendations Update to version 2.18.8 Update to version 2.21.4 Update to version 3.1.4

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-54513

GHSA-RMJ7-2VXQ-3G9F

Affected Products

Jackson-Databind

References · 11

• https://osv.dev/vulnerability/GHSA-rmj7-2vxq-3g9f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54513 · Security Note
• https://github.com/FasterXML/jackson-databind · Note
• https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5 · Note
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f · Note
• https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e · Note
• https://github.com/FasterXML/jackson-databind/issues/5981 · Note
• https://github.com/FasterXML/jackson-databind/issues/5983 · Note
• https://github.com/FasterXML/jackson-databind/pull/5984 · Note
• https://twitter.com/VulmonFeeds/status/2069568887775957415 · Twitter Post
• https://twitter.com/dailycve/status/2069546418214216023 · Twitter Post