Skip to main content

jackson-databind EUVDEUVD-2026-38593

| CVE-2026-54513 HIGH
Incomplete List of Disallowed Inputs (CWE-184)
2026-06-23 security-advisories@github.com GHSA-rmj7-2vxq-3g9f
Authentication Bypass Jackson Databind Fasterxml
8.1
CVSS 3.1 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify endpoint accepting polymorphic JSON
  2. Delivery
    Confirm PTV uses allowIfSubTypeIsArray
  3. Exploit
    Craft array payload wrapping denied gadget type
  4. Execution
    Submit JSON to deserializer
  5. Persist
    PTV approves array, instantiates component without recheck
  6. Impact
    Gadget executes attacker-controlled side effect

Vulnerability Assessment

Weakness
CWE
CWE-184
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation completeness
Exploitation Conditions

Requires the target application to (1) use jackson-databind in an affected version range, (2) construct a BasicPolymorphicTypeValidator that calls allowIfSubTypeIsArray() in combination with an explicit concrete-type allowlist (allowIfSubType), (3) enable polymorphic deserialization via activateDefaultTyping or @JsonTypeInfo against attacker-controlled JSON, and (4) have a usable gadget class available on the classpath for meaningful impact. The bypass specifically only takes effect when no per-element type IDs are present in the JSON, so configurations using JsonTypeInfo.As.PROPERTY with per-element IDs that re-trigger PTV are not exposed. The high attack complexity (CVSS AC:H) reflects these stacked configuration prerequisites.
Impact

CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) - high impact across CIA but AC:H reflects that exploitation requires the application to (a) use BasicPolymorphicTypeValidator, (b) explicitly call allowIfSubTypeIsArray(), and (c) deserialize attacker-controlled JSON into a polymorphic type without per-element type IDs. No EPSS, KEV, or SSVC data was provided and no public exploit was identified at time of analysis, so this is currently a high-severity supply-chain risk rather than a confirmed mass-exploitation event. The realistic concern is the well-documented gadget-instantiation ecosystem around jackson-databind: any classpath that includes a known gadget (e.g., JNDI-loading classes) becomes RCE-capable once an attacker can re-introduce a denied component type. Note the configuration prerequisite genuinely limits blast radius - applications using PTV without allowIfSubTypeIsArray(), or not using PTV at all, are unaffected by this specific bypass.
Exploit ScenarioDerived

An attacker submits JSON to an endpoint that deserializes into a polymorphic field guarded by a PTV configured with allowIfSubTypeIsArray() plus a strict element allowlist; the attacker supplies an array of a non-allowlisted gadget class (e.g., '["java.lang.Object",[{...EvilType payload...}]]'), which the PTV approves at the array level and Jackson then instantiates each component as the denied class via plain bean deserialization. If the classpath contains a known gadget (JNDI lookup, SSRF, file write), this yields the same outcome as historical jackson-databind RCE chains. No public PoC is published yet, but the GitHub issue, fix commits, and diff describe the bypass clearly enough for one to be reproduced.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 23, 2026

Allowlist bypass in jackson-databind's BasicPolymorphicTypeValidator (PTV) allows attackers to instantiate non-allowlisted classes by wrapping them in arrays (e.g., EvilType[]), defeating a control intended to block deserialization gadget chains. Affects versions 2.10.0 through 2.18.7, 2.19.0 through 2.21.3, and 3.0.0 through 3.1.3 when applications use allowIfSubTypeIsArray() alongside an explicit concrete-type allowlist. No public exploit identified at time of analysis, but the upstream fix and full root-cause writeup are public on GitHub.

RemediationAI

Vendor-released patches: upgrade to jackson-databind 2.18.8, 2.21.4, or 3.1.4 depending on your branch (released 2026-06-04, see GHSA-rmj7-2vxq-3g9f and PRs #5983 and #5984). Note a behavior change: after upgrading, allowIfSubTypeIsArray() now validates element types, so callers that implicitly relied on 'allow every array' must also allowlist the concrete element types they expect, or array deserialization will start failing - review serialization tests before rolling to production. If immediate patching is not possible, remove the allowIfSubTypeIsArray() call from your PTV configuration and instead explicitly allowlist the concrete element classes you need with allowIfSubType(Class) (trade-off: code change and possible loss of legitimate array support); alternatively avoid Default Typing entirely and use @JsonTypeInfo with a tight type ID resolver, which routes per-element types back through PTV.

Affected VersionsENISA

jackson-databind 2.10.0, < 2.18.8
jackson-databind 2.19.0, < 2.21.4
jackson-databind 3.0.0, < 3.1.4

Affected Packages

maven com.fasterxml.jackson.core:jackson-databind fix: 2.18.8, 2.21.4, 3.1.4
maven tools.jackson.core:jackson-databind fix: 3.1.4
euvd jackson_databind_2_10_0 fix: 2.18.8
euvd jackson_databind_2_19_0 fix: 2.21.4
euvd jackson_databind_3_0_0 fix: 3.1.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

jackson-databind is the FasterXML data-binding layer for the Jackson JSON processor and the de-facto JSON library across the Java ecosystem. PolymorphicTypeValidator (PTV), introduced in 2.10.0, is the safeguard added after the long history of Jackson deserialization-gadget CVEs; BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() was supposed to permit array container types while still relying on the validator to gate concrete component types. The validator only checked clazz.isArray() and never recursed into the component type, so when Default Typing or @JsonTypeInfo carried no per-element type IDs, Jackson instantiated the component class through normal bean deserialization with no second PTV invocation - the textbook CWE-184 (Incomplete List of Disallowed Inputs), with CWE-502 (Unsafe Deserialization) as the downstream impact class. The fix replaces the always-true array matcher with an _acceptArrayTypes flag that unwraps arrays recursively and validates the innermost element type against the configured matchers.

Know when Jackson Databind gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 8.1 HIGH

Network-reachable JSON input with no auth, but AC:H because exploitation requires a specific PTV builder configuration and a usable classpath gadget; full CIA impact via deserialization.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.1 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Patch available
Jun 23, 2026 - 22:02 EUVD

DescriptionCVE.org

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 7,613 maven packages depend on com.fasterxml.jackson.core:jackson-databind (2,139 direct, 5,569 indirect)
  • 378 maven packages depend on tools.jackson.core:jackson-databind (107 direct, 271 indirect)

Ecosystem-wide dependent count for version 2.10.0 and other introduced versions.

Executive ViewAI

Why It Matters

Jackson-databind versions 2.10.0-2.18.7, 2.19.0-2.21.3, and 3.0.0-3.1.3 contain a critical allowlist bypass in the BasicPolymorphicTypeValidator that permits attackers to instantiate unintended classes through array-wrapped deserialization payloads, enabling arbitrary code execution. All Java applications using affected versions to deserialize untrusted JSON data face direct exposure to advanced gadget chain attacks.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable allowIfSubTypeIsArray() unless mandatory for business logic; (2) Replace polymorphic type deserialization with explicit type mappings for untrusted inputs; (3) Implement pre-deserialization input validation to detect and reject array-wrapped class patterns; (4) Run affected services with minimal privilege and resource limits; (5) Deploy Web Application Firewall rules targeting suspicious polymorphic deserialization payloads; (6) Enable centralized alerting on serialization exceptions (ClassNotFoundException, InvalidTypeIdException) during request processing.

Threat Intelligence Overview

EPSS Score
0.6%
Top 56% exploitable
Prevalence
Ubiquitous
jackson-databind is the default JSON library across the Java ecosystem
Threat Intel
1
1 source
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Jackson Databind

View all
CVE-2020-11113 HIGH
8.8 Mar 31

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9547 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9548 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35728 HIGH
8.1 Dec 27

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2019-12086 HIGH POC
7.5 May 17

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. Rated high severity (CVSS 7.5)
CVE-2020-8840 CRITICAL
9.8 Feb 10

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apac
CVE-2020-25649 HIGH POC
7.5 Dec 03

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
CVE-2019-12384 MEDIUM
5.9 Jun 24

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure t
CVE-2020-35491 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2018-7489 CRITICAL
9.8 Feb 26

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote co
CVE-2020-35490 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-36183 HIGH POC
8.1 Jan 07

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela

Same weakness CWE-184 – Incomplete List of Disallowed Inputs

View all
CVE-2026-34415 CRITICAL POC
9.3
CVE-2026-41264 CRITICAL POC
9.2
CVE-2026-70470 CRITICAL POC
9.5
CVE-2024-5217 CRITICAL POC
9.2
CVE-2023-2017 HIGH POC
8.8
CVE-2023-29003 HIGH POC
8.8
CVE-2021-25631 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/373014 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-54513 REF https://access.redhat.com/errata/RHSA-2026:36839 REF https://access.redhat.com/errata/RHSA-2026:40895 REF https://access.redhat.com/errata/RHSA-2026:41951 REF https://access.redhat.com/errata/RHSA-2026:43218 REF https://access.redhat.com/errata/RHSA-2026:43400 REF https://access.redhat.com/errata/RHSA-2026:44061 REF https://access.redhat.com/errata/RHSA-2026:44062 REF https://access.redhat.com/errata/RHSA-2026:44063 REF https://access.redhat.com/errata/RHSA-2026:44064 REF https://access.redhat.com/errata/RHSA-2026:44065 REF https://access.redhat.com/errata/RHSA-2026:44066 REF https://access.redhat.com/errata/RHSA-2026:44271 REF https://access.redhat.com/errata/RHSA-2026:48095 REF https://access.redhat.com/errata/RHSA-2026:48151 REF https://access.redhat.com/errata/RHSA-2026:50846 REF https://access.redhat.com/errata/RHSA-2026:50847 REF https://access.redhat.com/errata/RHSA-2026:50848 REF https://access.redhat.com/errata/RHSA-2026:50849 REF https://access.redhat.com/errata/RHSA-2026:54435 REF https://access.redhat.com/errata/RHSA-2026:54622 REF https://access.redhat.com/errata/RHSA-2026:62260 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-54513 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492010 REF https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5 REF https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e REF https://github.com/FasterXML/jackson-databind/issues/5981 REF https://github.com/FasterXML/jackson-databind/issues/5983 REF https://github.com/FasterXML/jackson-databind/pull/5984 REF https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy