CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

High 8.1 Published 23 Jun 2026 Updated 14 Sep 2026

Attackers can bypass polymorphic type validation in jackson-databind to execute arbitrary code via crafted array deserialization.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-54513?

CVE-2026-54513 is a high-severity unsafe deserialization vulnerability in Fasterxml Jackson-Databind, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Weakness: CWE-184

Which versions are affected by CVE-2026-54513?

8 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind. It affects 1 product.

Package	Affected	Fixed in
`com.fasterxml.jackson.core:jackson-databind` Maven	From `2.10.0`	`2.18.8`
`com.fasterxml.jackson.core:jackson-databind` Maven	From `2.10.0`	`2.18.8`
`com.fasterxml.jackson.core:jackson-databind` Maven	From `2.19.0`	`2.21.4`
`com.fasterxml.jackson.core:jackson-databind` Maven	From `2.19.0`	`2.21.4`
`com.fasterxml.jackson.core:jackson-databind` Maven	From `3.0.0`	`3.1.4`
`com.fasterxml.jackson.core:jackson-databind` Maven	From `3.0.0`	`3.1.4`

2 more packages

`tools.jackson.core:jackson-databind` Maven	From `3.0.0`	`3.1.4`
`tools.jackson.core:jackson-databind` Maven	From `3.0.0`	`3.1.4`

Linux distribution packages (32)

`apache-commons-collections` AlmaLinux:8	All versions	`3.2.2-10.module_el8.5.0+2577+9e95fe00`
`apache-commons-lang` AlmaLinux:8	All versions	`2.6-21.module_el8.5.0+2577+9e95fe00`
`apache-commons-net` AlmaLinux:8	All versions	`3.6-3.module_el8.5.0+2577+9e95fe00`
`bea-stax-api` AlmaLinux:8	All versions	`1.2.0-16.module_el8.5.0+2577+9e95fe00`
`glassfish-fastinfoset` AlmaLinux:8	All versions	`1.2.13-9.module_el8.5.0+2577+9e95fe00`
`glassfish-jaxb-api` AlmaLinux:8	All versions	`2.2.12-8.module_el8.5.0+2577+9e95fe00`
`glassfish-jaxb-core` AlmaLinux:8	All versions	`2.2.11-12.module_el8.10.0+3791+e0637953`
`glassfish-jaxb-runtime` AlmaLinux:8	All versions	`2.2.11-12.module_el8.10.0+3791+e0637953`
`glassfish-jaxb-txw2` AlmaLinux:8	All versions	`2.2.11-12.module_el8.10.0+3791+e0637953`
`jackson-annotations` AlmaLinux:8	All versions	`2.21-1.module_el8.10.0+4235+0924958e`
`jackson-core` AlmaLinux:8	All versions	`2.21.4-1.module_el8.10.0+4235+0924958e`
`jackson-databind` AlmaLinux:8	All versions	`2.21.4-1.module_el8.10.0+4235+0924958e`
`jackson-jaxrs-json-provider` AlmaLinux:8	All versions	`2.21.4-1.module_el8.10.0+4235+0924958e`
`jackson-jaxrs-providers` AlmaLinux:8	All versions	`2.21.4-1.module_el8.10.0+4235+0924958e`
`jackson-module-jaxb-annotations` AlmaLinux:8	All versions	`2.21.4-2.module_el8.10.0+4235+0924958e`
`jakarta-commons-httpclient` AlmaLinux:8	All versions	`1:3.1-28.module_el8.5.0+2577+9e95fe00`
`javassist` AlmaLinux:8	All versions	`3.18.1-8.module_el8.5.0+2577+9e95fe00`
`javassist-javadoc` AlmaLinux:8	All versions	`3.18.1-8.module_el8.5.0+2577+9e95fe00`
`pki-servlet-engine` AlmaLinux:8	All versions	`1:9.0.62-1.module_el8.10.0+3791+e0637953`
`relaxngDatatype` AlmaLinux:8	All versions	`2011.1-7.module_el8.5.0+2577+9e95fe00`
`slf4j` AlmaLinux:8	All versions	`1.7.25-4.module_el8.5.0+2577+9e95fe00`
`slf4j-jdk14` AlmaLinux:8	All versions	`1.7.25-4.module_el8.5.0+2577+9e95fe00`
`stax-ex` AlmaLinux:8	All versions	`1.7.7-8.module_el8.5.0+2577+9e95fe00`
`velocity` AlmaLinux:8	All versions	`1.7-24.module_el8.5.0+2577+9e95fe00`
`xalan-j2` AlmaLinux:8	All versions	`2.7.1-38.module_el8.5.0+2577+9e95fe00`
`xerces-j2` AlmaLinux:8	All versions	`2.11.0-34.module_el8.5.0+2577+9e95fe00`
`xml-commons-apis` AlmaLinux:8	All versions	`1.4.01-25.module_el8.5.0+2577+9e95fe00`
`xml-commons-resolver` AlmaLinux:8	All versions	`1.2-26.module_el8.5.0+2577+9e95fe00`
`xmlstreambuffer` AlmaLinux:8	All versions	`1.5.4-8.module_el8.5.0+2577+9e95fe00`
`xsom` AlmaLinux:8	All versions	`0-19.20110809svn.module_el8.5.0+2577+9e95fe00`
`apache-commons-collections` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.2.2-10.module+el8.10.0+20993+d0f024b0`
`apache-commons-lang` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.6-21.module+el8.10.0+20993+d0f024b0`

Products include Fasterxml Jackson-Databind.

How do I fix CVE-2026-54513?

Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.18.8, 2.21.4 or 3.1.4.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-54513 being exploited?

There is no known exploitation of CVE-2026-54513 in the wild and no public exploit code.

All Fasterxml Jackson-Databind vulnerabilities

Sources

Also known as ALSA-2026:43218, CLEANSTART-2026-BJ10269, CLEANSTART-2026-ES07663, CLEANSTART-2026-HT58355, CLEANSTART-2026-KA63622, CLEANSTART-2026-MM99608 and 188 more.