jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Summary
BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist.
Impact
Applications using BasicPolymorphicTypeValidator with allowIfSubTypeIsArray() as a safeguard get no protection for concrete array component types; an attacker controlling JSON can instantiate non-allowlisted types via an array wrapper, re-opening the gadget-instantiation risk PTV is meant to prevent.
Affected / Patched (verified via git tag --contains)
- 2.18 line:
>= 2.10.0, < 2.18.8-> fixed in 2.18.8 - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4
PolymorphicTypeValidator was added in 2.10.0 so vulnerability N/A for versions prior to that.
Severity / CWE
Maintainer: significant. Reporter: HIGH. CWE-184 (Incomplete List of Disallowed Inputs); related CWE-502.
Upstream fix
FasterXML/jackson-databind#5981; fix PR #5983 (24529da), 2.18 backport PR #5984 (01d1692). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Java / Kotlin (Maven) | com.fasterxml.jackson.core:jackson-databind | >= 2.10.0, < 2.18.8, >= 2.19.0, < 2.21.4, >= 3.0.0, < 3.1.4 | 2.18.8, 2.21.4, 3.1.4 |
| Java / Kotlin (Maven) | tools.jackson.core:jackson-databind | >= 3.0.0, < 3.1.4 | 3.1.4 |
Odnośniki
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f
- https://nvd.nist.gov/vuln/detail/CVE-2026-54513
- https://github.com/FasterXML/jackson-databind/issues/5983
- https://github.com/FasterXML/jackson-databind/issues/5981
- https://github.com/FasterXML/jackson-databind/pull/5984
- https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e
- https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5
- https://access.redhat.com/errata/RHSA-2026:50849
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:54622
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/security/cve/CVE-2026-54513
- https://bugzilla.redhat.com/show_bug.cgi?id=2492010
- https://github.com/FasterXML/jackson-databind
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json
- https://access.redhat.com/errata/RHSA-2026:36839
- https://access.redhat.com/errata/RHSA-2026:40895
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:43218
- https://access.redhat.com/errata/RHSA-2026:43400
- https://access.redhat.com/errata/RHSA-2026:44061
- https://access.redhat.com/errata/RHSA-2026:44062
- https://access.redhat.com/errata/RHSA-2026:44063
- https://access.redhat.com/errata/RHSA-2026:44064
- https://access.redhat.com/errata/RHSA-2026:44065
- https://access.redhat.com/errata/RHSA-2026:44066
- https://access.redhat.com/errata/RHSA-2026:44271
- https://access.redhat.com/errata/RHSA-2026:48095
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:50846
- https://access.redhat.com/errata/RHSA-2026:50847
- https://access.redhat.com/errata/RHSA-2026:50848
- Wektor CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Słabość (CWE)
CWE-184- Platforma
- Java / Kotlin (Maven)
- Paczka
com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind- Ujawniono
- 23.06.2026
- Aktualizacja
- 11.10.2026 13:20
Źródła i licencje
OSV / GitHub Advisory Database - GHSA-rmj7-2vxq-3g9f - CC BY 4.0
Historia podatności: tools.jackson.core:jackson-databind
Wszystkie opisane podatności tej paczki (Java / Kotlin (Maven)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 15
- Pierwsza → ostatnia
- 06.2026 09.2026
- Bez poprawki
- 0
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Wysoka 5
- Średnia 10
Ujawnienia w latach
- 2026: 15
-
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.