Skip to main content

jackson-databind CVE-2026-54512

| EUVDEUVD-2026-38595 HIGH
Incomplete List of Disallowed Inputs (CWE-184)
2026-06-23 security-advisories@github.com GHSA-j3rv-43j4-c7qm
Deserialization Canonical Jackson Databind Fasterxml
8.1
CVSS 3.1 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Identify endpoint accepting polymorphic JSON
  2. Delivery
    Probe configured PTV allow-list and classpath gadgets
  3. Exploit
    Craft type ID with allowed container wrapping denied gadget
  4. Install
    Submit JSON triggering generic deserialization
  5. C2
    Gadget class loaded via Class.forName and instantiated
  6. Execute
    Setter-driven side effects execute (JNDI/JDBC/template)
  7. Impact
    Remote code execution or data exfiltration

Vulnerability Assessment

Weakness
CWE
CWE-184
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation completeness
Exploitation Conditions

Application must (1) use jackson-databind 2.10.0-2.18.7, 2.19.0-2.21.3, or 3.0.0-3.1.3, (2) have polymorphic typing enabled either via activateDefaultTyping/enableDefaultTyping or via @JsonTypeInfo with Id.CLASS or Id.MINIMAL_CLASS on a field/type reachable from untrusted input, (3) have a configured PolymorphicTypeValidator that allow-lists at least one container class capable of holding generic parameters (List, Map, Set, arrays, etc.) - bypass is meaningless if no PTV is configured, since deserialization is already unrestricted there. Exploitation further requires an instantiable gadget class on the classpath whose property setters produce useful side effects; without such a gadget, impact is limited to arbitrary class loading and constructor execution rather than full RCE. AC:H reflects the multi-step type-ID crafting and gadget discovery; PR:N/UI:N hold only when the JSON endpoint is reachable without authentication.
Impact

CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects high impact tempered by AC:H, which is appropriate because exploitation depends on the application (a) enabling polymorphic typing, (b) accepting attacker-controlled type IDs, and (c) having a suitable gadget class on the classpath. EPSS and KEV data were not supplied, and no public exploit identified at time of analysis - only the advisory's PoC snippet exists. The realistic risk is moderate-to-high for any service that processes untrusted JSON with default-typing or @JsonTypeInfo plus a configured PTV (precisely the configuration security guidance has recommended), because that configuration becomes a false sense of security. The library's enormous deployment footprint elevates aggregate risk even if any single application's exposure depends on its serialization design.
Exploit ScenarioDerived

A web service deserializes user-submitted JSON into a wrapper field typed as Object using polymorphic typing, hardened with BasicPolymorphicTypeValidator.allowIfSubType("java.util.ArrayList"). The attacker submits a type ID such as java.util.ArrayList<com.example.GadgetOnClasspath> with JSON properties that drive the gadget's setters; the container clears PTV, the parameterized gadget class is loaded and instantiated, and its side effects (JNDI lookup, JDBC URL coercion, template compilation) execute under the application's identity.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 23, 2026

PolymorphicTypeValidator bypass in jackson-databind versions 2.10.0 through 2.18.7, 2.19.0 through 2.21.3, and 3.0.0 through 3.1.3 allows attackers controlling JSON type identifiers to smuggle denied gadget classes through allow-listed generic containers, leading to arbitrary class instantiation and potential remote code execution. The flaw stems from DatabindContext._resolveAndValidateGeneric() validating only the raw container class name while skipping all nested generic type arguments. No public exploit identified at time of analysis, but the GHSA advisory includes a proof-of-concept configuration and payload structure.

RemediationAI

Vendor-released patches are available: upgrade to jackson-databind 2.18.8, 2.21.4, or 3.1.4 depending on your release line, per the GHSA-j3rv-43j4-c7qm advisory and commit https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5. If patching is delayed, the highest-leverage compensating controls are to disable default typing entirely (ObjectMapper.deactivateDefaultTyping() and remove @JsonTypeInfo(use=JsonTypeInfo.Id.CLASS/MINIMAL_CLASS) on fields holding untrusted data), avoid deserializing into Object/Serializable/Comparable typed fields from external input, and tighten the PTV to allow only concrete, non-generic, fully-qualified element types rather than broad name prefixes - accepting that this will break legitimate polymorphic flows. Auditing the classpath to remove known gadget libraries (commons-collections older versions, JNDI providers, c3p0, Spring AOP utilities, xalan TemplatesImpl reachability) further reduces blast radius.

Affected VersionsENISA

jackson-databind 2.10.0, < 2.18.8
jackson-databind 3.0.0, < 3.1.4
jackson-databind 2.19.0, < 2.21.4

Affected Packages

maven com.fasterxml.jackson.core:jackson-databind fix: 2.18.8, 2.21.4, 3.1.4
maven tools.jackson.core:jackson-databind fix: 3.1.4
euvd jackson_databind_2_10_0 fix: 2.18.8
euvd jackson_databind_2_19_0 fix: 2.21.4
euvd jackson_databind_3_0_0 fix: 3.1.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

jackson-databind is the data-binding module of the Jackson JSON processor, ubiquitous across the Java ecosystem for serializing and deserializing JSON to/from POJOs. The PolymorphicTypeValidator (PTV) - typically BasicPolymorphicTypeValidator with allowIfSubType name-prefix rules - is the documented hardening mechanism against the long line of Jackson deserialization gadget-chain CVEs (CWE-184, Incomplete List of Disallowed Inputs). The defect is in DatabindContext._resolveAndValidateGeneric(): when a type ID contains '<', the validator inspects only the substring before '<' (the container raw class), then calls TypeFactory.constructFromCanonical() on the full string, parsing and resolving nested type arguments via Class.forName without re-running them through the PTV. The patched code adds a recursive _validateTypeParameter() walker that validates every contained type and array component against both name- and class-based PTV rules.

Know when Jackson Databind gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 8.1 HIGH

Network-reachable JSON endpoint with no auth or UI; AC:H because exploitation needs polymorphic typing, a configured PTV, and a usable classpath gadget; full CIA impact via arbitrary instantiation.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.1 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Patch available
Jun 23, 2026 - 22:02 EUVD

DescriptionCVE.org

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container - for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 7,614 maven packages depend on com.fasterxml.jackson.core:jackson-databind (2,139 direct, 5,570 indirect)
  • 377 maven packages depend on tools.jackson.core:jackson-databind (107 direct, 270 indirect)

Ecosystem-wide dependent count for version 2.10.0 and other introduced versions.

Executive ViewAI

Why It Matters

Jackson databind, the JSON processing library embedded across thousands of Java applications and REST APIs, contains a remote code execution vulnerability (CVSS 8.1) with no vendor patch currently available. Organizations using affected versions face potential compromise through malicious JSON requests, with public technical details available enabling attack development. Urgent inventory of exposure and implementation of containment controls is required to reduce risk of exploitation.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) configure strict type whitelisting and disable polymorphic deserialization where not required; (2) implement input validation, payload size limits, and request rate limiting on JSON endpoints; (3) apply network segmentation and WAF rules to restrict JSON processing endpoints to trusted internal and partner sources only; (4) run affected services with minimal OS privileges and separate process isolation; (5) enable detailed logging and alerting on deserialization exceptions and unusual class instantiation patterns for anomaly detection.

Threat Intelligence Overview

EPSS Score
0.6%
Top 56% exploitable
Prevalence
Ubiquitous
jackson-databind is the de facto JSON library across the Java ecosystem
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

61
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +40
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

More in Jackson Databind

View all
CVE-2020-11113 HIGH
8.8 Mar 31

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9547 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9548 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35728 HIGH
8.1 Dec 27

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2019-12086 HIGH POC
7.5 May 17

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. Rated high severity (CVSS 7.5)
CVE-2020-8840 CRITICAL
9.8 Feb 10

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apac
CVE-2020-25649 HIGH POC
7.5 Dec 03

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
CVE-2019-12384 MEDIUM
5.9 Jun 24

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure t
CVE-2020-35491 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2018-7489 CRITICAL
9.8 Feb 26

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote co
CVE-2020-35490 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-36183 HIGH POC
8.1 Jan 07

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela

Same weakness CWE-184 – Incomplete List of Disallowed Inputs

View all
CVE-2026-34415 CRITICAL POC
9.3
CVE-2026-41264 CRITICAL POC
9.2
CVE-2026-70470 CRITICAL POC
9.5
CVE-2023-2017 HIGH POC
8.8
CVE-2024-5217 CRITICAL POC
9.2
CVE-2023-29003 HIGH POC
8.8
CVE-2021-25631 HIGH POC
8.8

Same technique Deserialization

View all
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2020-0618 HIGH POC
8.8
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:36839 ADVISORY https://access.redhat.com/errata/RHSA-2026:40895 ADVISORY https://access.redhat.com/errata/RHSA-2026:41951 ADVISORY https://access.redhat.com/errata/RHSA-2026:43400 ADVISORY https://access.redhat.com/errata/RHSA-2026:44061 ADVISORY https://access.redhat.com/errata/RHSA-2026:44062 ADVISORY https://access.redhat.com/errata/RHSA-2026:44063 ADVISORY https://access.redhat.com/errata/RHSA-2026:44064 ADVISORY https://access.redhat.com/errata/RHSA-2026:44065 ADVISORY https://access.redhat.com/errata/RHSA-2026:44066 ADVISORY https://access.redhat.com/errata/RHSA-2026:44271 ADVISORY https://vuldb.com/vuln/373043 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-54512 REF https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5 REF https://github.com/FasterXML/jackson-databind/issues/5988 REF https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy