Vulnpedia
← All CVEs

CVE-2026-54513

HIGH 8.1

Published 2026-06-23 · Last modified 2026-07-21

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

ELEVATED IMPACT

Severe if exploited (CVSS 8.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.7%chance of exploitation in 30 days · 49th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

8.1CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-54513/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-54513/poc.json

Affected

Vendors Fasterxml Red Hat

Products Jackson Databind Red Hat Build Of Apache Camel 4.18 For Quarkus 3.33 Red Hat Data Grid 8.6.2 Red Hat Enterprise Linux 9 Cryostat 4 Openshift Developer Tools And Services Openshift Serverless Red Hat Ai Inference Server Red Hat Amq Broker 7 Red Hat Amq Clients Red Hat Ansible Automation Platform 2 Red Hat Build Of Apache Camel 4 For Quarkus 3

Weakness (CWE)

  • CWE-184: : Incomplete List of Disallowed Inputs

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Affected Software Configurations

VendorProductVersion range
FasterxmlJackson Databind≥ 2.10.0 and < 2.18.8
FasterxmlJackson Databind≥ 2.19.0 and < 2.21.4
FasterxmlJackson Databind≥ 3.0.0 and < 3.1.4

All CVSS metrics

  • HIGH 8.1 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • HIGH 8.1 v3.1 · ADP Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • HIGH 8.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS