CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

What is CVE-2026-54512?

CVE-2026-54512 is a high-severity unsafe deserialization vulnerability in Fasterxml Jackson-Databind, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Weakness: CWE-502, CWE-184

Which versions are affected by CVE-2026-54512?

8 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind. It affects 1 product.

Products include Fasterxml Jackson-Databind.

How do I fix CVE-2026-54512?

Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.18.8, 2.21.4 or 3.1.4.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-54512 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54512 exists.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in Fasterxml Jackson-Databind

• CVE-2018-11307 Deserialization of Untrusted Data in jackson-databind Critical 9.8
• CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) High 8.1
• CVE-2020-14060 Deserialization of untrusted data in Jackson Databind High 8.1
• CVE-2021-46877 jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode High 7.5
• CVE-2019-14893 Polymorphic deserialization of malicious object in jackson-databind High 7.5

All Fasterxml Jackson-Databind vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-BN64162, CLEANSTART-2026-DP19195, CLEANSTART-2026-DQ63138, CLEANSTART-2026-GO55910, CLEANSTART-2026-HB97170, CLEANSTART-2026-HO78740 and 184 more.