{"id":"CVE-2026-54513","summary":"jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)","details":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.","aliases":["GHSA-rmj7-2vxq-3g9f"],"modified":"2026-07-25T04:14:35.142493897Z","published":"2026-06-23T20:53:52.543Z","related":["ALSA-2026:40895","ALSA-2026:43218","ALSA-2026:43400","CGA-4qr5-c8qc-3ffp","SUSE-SU-2026:22504-1","SUSE-SU-2026:2801-1","openSUSE-SU-2026:11118-1","openSUSE-SU-2026:21201-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54513.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-184"]},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36839"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40895"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43218"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43400"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44061"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44062"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44063"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44064"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44065"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44066"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44271"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-54513"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54513.json"},{"type":"ADVISORY","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492010"},{"type":"REPORT","url":"https://github.com/FasterXML/jackson-databind/issues/5981"},{"type":"REPORT","url":"https://github.com/FasterXML/jackson-databind/issues/5983"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/pull/5984"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fasterxml/jackson-databind","events":[{"introduced":"a1eedfdeea46f2a8da0ed23f06e7e1d39050499b"},{"fixed":"0b422144d1785200e44a0b00c973f6ac95adcf5a"},{"introduced":"f644a920f4ac768797edf7709070411837c83ef8"},{"fixed":"dd72fa6c89b5cea6c4eba5a8604f248bbc5d93e5"},{"introduced":"d51183e4fa171235bcd31c63268c5ad1745afb8c"},{"fixed":"0105ba7c8c7d2aa59707c458eeb6c27e77779734"},{"fixed":"01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"},{"fixed":"24529da29fdf46ff94ca38de9ebf31cd188f5e8e"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.10.0"},{"fixed":"2.18.8"},{"introduced":"2.19.0"},{"fixed":"2.21.4"},{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}}],"versions":["jackson-databind-3.1.3","jackson-databind-2.21.3","jackson-databind-2.18.7","jackson-databind-3.1.2","jackson-databind-3.1.1","jackson-databind-2.21.2","jackson-databind-3.1.0","jackson-databind-2.21.1","jackson-databind-2.18.6","jackson-databind-3.1.0-rc1","jackson-databind-2.21.0","jackson-databind-2.18.5","jackson-databind-3.0.1","jackson-databind-3.0.0","jackson-databind-2.20.0","jackson-databind-2.20.0-rc1","jackson-databind-2.18.4","jackson-databind-2.19.0","jackson-databind-2.18.3","jackson-databind-2.18.2","jackson-databind-2.18.1","jackson-databind-2.18.0","jackson-databind-2.18.0-rc1","jackson-databind-2.17.0-rc1","jackson-databind-2.16.0","jackson-databind-2.16.0-rc1","jackson-databind-2.15.0","jackson-databind-2.15.0-rc3","jackson-databind-2.15.0-rc2","jackson-databind-2.15.0-rc1","jackson-databind-2.14.0","jackson-databind-2.14.0-rc3","jackson-databind-2.14.0-rc2","jackson-databind-2.14.0-rc1","jackson-databind-2.13.0","jackson-databind-2.13.0-rc2","jackson-databind-2.13.0-rc1","jackson-databind-2.12.1","jackson-databind-2.12.0","jackson-databind-2.12.0-rc2","jackson-databind-2.12.0-rc1","jackson-databind-2.11.0","jackson-databind-2.11.0.rc1","jackson-databind-2.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54513.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}