Vulnerability-Lookup

RHSA-2026:40895

Vulnerability from csaf_redhat - Published: 2026-07-16 12:11 - Updated: 2026-07-21 21:12

Summary

Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

Severity

Important

Notes

Topic: An update for multiple packages is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fix(es): * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-54512

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502 - Deserialization of Untrusted Data

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src		—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch		—	Vendor Fix fix Workaround

Known not affected 9 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch	—	Workaround

Threats

Impact Important

CVE-2026-54513

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-184 - Incomplete List of Disallowed Inputs

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src		—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch		—	Vendor Fix fix Workaround

Known not affected 9 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch	—	Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch	—	Workaround

Threats

Impact Important

References

22 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:40895	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492010	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492015	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-54512	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492015	external
https://www.cve.org/CVERecord?id=CVE-2026-54512	external
https://nvd.nist.gov/vuln/detail/CVE-2026-54512	external
https://github.com/FasterXML/jackson-databind/com…	external
https://github.com/FasterXML/jackson-databind/iss…	external
https://github.com/FasterXML/jackson-databind/sec…	external
https://access.redhat.com/security/cve/CVE-2026-54513	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492010	external
https://www.cve.org/CVERecord?id=CVE-2026-54513	external
https://nvd.nist.gov/vuln/detail/CVE-2026-54513	external
https://github.com/FasterXML/jackson-databind/com…	external
https://github.com/FasterXML/jackson-databind/com…	external
https://github.com/FasterXML/jackson-databind/iss…	external
https://github.com/FasterXML/jackson-databind/iss…	external
https://github.com/FasterXML/jackson-databind/pull/5984	external
https://github.com/FasterXML/jackson-databind/sec…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for multiple packages is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.\n\nSecurity Fix(es):\n\n* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)\n\n* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:40895",
        "url": "https://access.redhat.com/errata/RHSA-2026:40895"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2492010",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
      },
      {
        "category": "external",
        "summary": "2492015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40895.json"
      }
    ],
    "title": "Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update",
    "tracking": {
      "current_release_date": "2026-07-21T21:12:04+00:00",
      "generator": {
        "date": "2026-07-21T21:12:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:40895",
      "initial_release_date": "2026-07-16T12:11:22+00:00",
      "revision_history": [
        {
          "date": "2026-07-16T12:11:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-16T12:11:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-21T21:12:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jackson-databind-0:2.21.4-1.el9_8.src",
                "product": {
                  "name": "jackson-databind-0:2.21.4-1.el9_8.src",
                  "product_id": "jackson-databind-0:2.21.4-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jackson-databind@2.21.4-1.el9_8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jackson-core-0:2.21.4-1.el9_8.src",
                "product": {
                  "name": "jackson-core-0:2.21.4-1.el9_8.src",
                  "product_id": "jackson-core-0:2.21.4-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jackson-core@2.21.4-1.el9_8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jackson-modules-base-0:2.21.4-1.el9_8.src",
                "product": {
                  "name": "jackson-modules-base-0:2.21.4-1.el9_8.src",
                  "product_id": "jackson-modules-base-0:2.21.4-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jackson-modules-base@2.21.4-1.el9_8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
                "product": {
                  "name": "jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
                  "product_id": "jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jackson-jaxrs-providers@2.21.4-1.el9_8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jackson-annotations-0:2.21-1.el9_8.src",
                "product": {
                  "name": "jackson-annotations-0:2.21-1.el9_8.src",
                  "product_id": "jackson-annotations-0:2.21-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jackson-annotations@2.21-1.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pki-jackson-databind-0:2.21.4-1.el9_8.noarch",
                "product": {
                  "name": "pki-jackson-databind-0:2.21.4-1.el9_8.noarch",
                  "product_id": "pki-jackson-databind-0:2.21.4-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pki-jackson-databind@2.21.4-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pki-jackson-core-0:2.21.4-1.el9_8.noarch",
                "product": {
                  "name": "pki-jackson-core-0:2.21.4-1.el9_8.noarch",
                  "product_id": "pki-jackson-core-0:2.21.4-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pki-jackson-core@2.21.4-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch",
                "product": {
                  "name": "pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch",
                  "product_id": "pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pki-jackson-module-jaxb-annotations@2.21.4-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
                "product": {
                  "name": "pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
                  "product_id": "pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pki-jackson-jaxrs-json-provider@2.21.4-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
                "product": {
                  "name": "pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
                  "product_id": "pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pki-jackson-jaxrs-providers@2.21.4-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pki-jackson-annotations-0:2.21-1.el9_8.noarch",
                "product": {
                  "name": "pki-jackson-annotations-0:2.21-1.el9_8.noarch",
                  "product_id": "pki-jackson-annotations-0:2.21-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pki-jackson-annotations@2.21-1.el9_8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-0:2.21-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src"
        },
        "product_reference": "jackson-annotations-0:2.21-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-0:2.21.4-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src"
        },
        "product_reference": "jackson-core-0:2.21.4-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-0:2.21.4-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src"
        },
        "product_reference": "jackson-databind-0:2.21.4-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-jaxrs-providers-0:2.21.4-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src"
        },
        "product_reference": "jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-modules-base-0:2.21.4-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src"
        },
        "product_reference": "jackson-modules-base-0:2.21.4-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-jackson-annotations-0:2.21-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch"
        },
        "product_reference": "pki-jackson-annotations-0:2.21-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-jackson-core-0:2.21.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch"
        },
        "product_reference": "pki-jackson-core-0:2.21.4-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-jackson-databind-0:2.21.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch"
        },
        "product_reference": "pki-jackson-databind-0:2.21.4-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch"
        },
        "product_reference": "pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch"
        },
        "product_reference": "pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch"
        },
        "product_reference": "pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-54512",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-06-23T22:01:49.821346+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch"
        ],
        "known_not_affected": [
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
          "url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5988"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
        }
      ],
      "release_date": "2026-06-23T20:56:36.646000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-16T12:11:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:40895"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
    },
    {
      "cve": "CVE-2026-54513",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "discovery_date": "2026-06-23T22:01:34.437620+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492010"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `jackson-databind` allows for a security bypass, enabling arbitrary code execution. The vulnerability arises from insufficient validation of array component types by `BasicPolymorphicTypeValidator`, which permits deserialization of unallowlisted types when processing untrusted input. This bypass of type validation can lead to a complete system compromise, affecting confidentiality, integrity, and availability in Red Hat products utilizing `jackson-databind` for data processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch"
        ],
        "known_not_affected": [
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54513"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492010",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54513",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54513"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5",
          "url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e",
          "url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5981",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5981"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5983",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5983"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/pull/5984",
          "url": "https://github.com/FasterXML/jackson-databind/pull/5984"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"
        }
      ],
      "release_date": "2026-06-23T20:53:52.543000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-16T12:11:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:40895"
        },
        {
          "category": "workaround",
          "details": "Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application\u2019s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change.\n\nAs an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-annotations-0:2.21-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-core-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-databind-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-jaxrs-providers-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:jackson-modules-base-0:2.21.4-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-annotations-0:2.21-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-core-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-databind-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution"
    }
  ]
}

CVE-2026-54512 (GCVE-0-2026-54512)

Vulnerability from cvelistv5 – Published: 2026-06-23 20:56 – Updated: 2026-06-24 15:22

Title

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

Summary

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-184 - Incomplete List of Disallowed Inputs
CWE-502 - Deserialization of Untrusted Data

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/FasterXML/jackson-databind/sec…	x_refsource_CONFIRM
https://github.com/FasterXML/jackson-databind/iss…	x_refsource_MISC
https://github.com/FasterXML/jackson-databind/com…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FasterXML	jackson-databind	Affected: >= 2.10.0, < 2.18.8 Affected: >= 2.19.0, < 2.21.4 Affected: >= 3.0.0, < 3.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54512",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-24T14:54:06.511108Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T15:22:43.268Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jackson-databind",
          "vendor": "FasterXML",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.10.0, \u003c 2.18.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.0, \u003c 2.21.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind\u0027s PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains \u003c), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before \u003c) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container \u2014 for example java.util.ArrayList\u003ccom.evil.Gadget\u003e when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T20:56:36.646Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
        },
        {
          "name": "https://github.com/FasterXML/jackson-databind/issues/5988",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/5988"
        },
        {
          "name": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
        }
      ],
      "source": {
        "advisory": "GHSA-j3rv-43j4-c7qm",
        "discovery": "UNKNOWN"
      },
      "title": "jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54512",
    "datePublished": "2026-06-23T20:56:36.646Z",
    "dateReserved": "2026-06-15T18:01:15.513Z",
    "dateUpdated": "2026-06-24T15:22:43.268Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54513 (GCVE-0-2026-54513)

Vulnerability from cvelistv5 – Published: 2026-06-23 20:53 – Updated: 2026-07-21 12:05

Title

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Summary

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-184 - Incomplete List of Disallowed Inputs

Assigner

GitHub_M

References

12 references

URL	Tags
https://github.com/FasterXML/jackson-databind/sec…	x_refsource_CONFIRM
https://github.com/FasterXML/jackson-databind/iss…	x_refsource_MISC
https://github.com/FasterXML/jackson-databind/iss…	x_refsource_MISC
https://github.com/FasterXML/jackson-databind/pull/5984	x_refsource_MISC
https://github.com/FasterXML/jackson-databind/com…	x_refsource_MISC
https://github.com/FasterXML/jackson-databind/com…	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-54513	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492010	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:40895	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36839	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41951	vendor-advisoryx_refsource_REDHAT

Impacted products

33 products

Vendor	Product	Version
FasterXML	jackson-databind	Affected: >= 2.10.0, < 2.18.8 Affected: >= 2.19.0, < 2.21.4 Affected: >= 3.0.0, < 3.1.4
Red Hat	Red Hat Build of Apache Camel 4.18 for Quarkus 3.33	cpe:/a:redhat:apache_camel_quarkus:3.33
Red Hat	Red Hat Data Grid 8.6.2	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.21.4-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	Red Hat AI Inference Server	cpe:/a:redhat:ai_inference_server:3
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat AMQ Clients	cpe:/a:redhat:amq_clients:2023
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	cpe:/a:redhat:camel_quarkus:3
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	cpe:/a:redhat:camel_spring_boot:4
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4
Red Hat	Red Hat build of Apicurio Registry 3	cpe:/a:redhat:apicurio_registry:3
Red Hat	Red Hat build of Debezium 3	cpe:/a:redhat:debezium:3
Red Hat	Red Hat Build of Keycloak	cpe:/a:redhat:build_keycloak:
Red Hat	Red Hat build of Quarkus	cpe:/a:redhat:quarkus:3
Red Hat	Red Hat Certificate System 10	cpe:/a:redhat:certificate_system:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Lightspeed for Runtimes Operator	cpe:/a:redhat:lightspeed_for_runtimes:1
Red Hat	Red Hat Offline Knowledge Portal	cpe:/a:redhat:offline_knowledge_portal:1
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7
Red Hat	streams for Apache Kafka 2	cpe:/a:redhat:amq_streams:2
Red Hat	streams for Apache Kafka 3	cpe:/a:redhat:amq_streams:3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54513",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-24T14:45:02.581065Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T14:45:22.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_quarkus:3.33"
            ],
            "defaultStatus": "unaffected",
            "packageName": "jackson-databind",
            "product": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "jackson-databind",
            "product": "Red Hat Data Grid 8.6.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.21.4-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "unknown",
            "packageName": "jenkins",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "unknown",
            "packageName": "jenkins-2-plugins",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "unknown",
            "packageName": "ocp-tools-4/jenkins-rhel8",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "unknown",
            "packageName": "ocp-tools-4/jenkins-rhel9",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhaii/vllm-gaudi-rhel9",
            "product": "Red Hat AI Inference Server",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "ansible-automation-platform-27/de-minimal-rhel9",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "ansible-automation-platform-27/de-supported-rhel9",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "python3.11-drools-jpy-jar",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "python3.12-drools-jpy-jar",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "python3x-drools-jpy-jar",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "python-drools-jpy-jar",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_spring_boot:4"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat build of Apache Camel for Spring Boot 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_hawtio:4"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat build of Apache Camel - HawtIO 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat build of Quarkus",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:certificate_system:10"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-pki:10/redhat-pki",
            "product": "Red Hat Certificate System 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "dogtag-pki",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "pki-deps:10.6/jackson-databind",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhelai3/bootc-gaudi-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8",
            "product": "Red Hat JBoss Enterprise Application Platform 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8",
            "product": "Red Hat JBoss Enterprise Application Platform 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8",
            "product": "Red Hat JBoss Enterprise Application Platform 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8",
            "product": "Red Hat JBoss Enterprise Application Platform 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "jackson-databind-2.15.0.jar",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "jackson-databind-2.15.0.module",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "jackson-databind-nullable",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lightspeed_for_runtimes:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "rh-lightspeed-runtimes/runtimes-agent-init-rhel9",
            "product": "Red Hat Lightspeed for Runtimes Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:offline_knowledge_portal:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "offline-knowledge-portal/rhokp-rhel9",
            "product": "Red Hat Offline Knowledge Portal",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-modelmesh-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-vllm-gaudi-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "openvox-server",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "puppetserver",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "satellite-capsule:el8/puppetserver",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "satellite:el8/candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "jackson-databind",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-23T20:53:52.543Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-184",
                "description": "Incomplete List of Disallowed Inputs",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T12:05:18.406Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-54513"
          },
          {
            "name": "RHBZ#2492010",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40895"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36839"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41951"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:40895: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36839: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-23T22:01:34.437Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-23T20:53:52.543Z",
            "value": "Made public."
          }
        ],
        "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution",
        "workarounds": [
          {
            "lang": "en",
            "value": "Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application\u2019s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change.\n\nAs an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jackson-databind",
          "vendor": "FasterXML",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.10.0, \u003c 2.18.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.0, \u003c 2.21.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array\u0027s component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T20:57:16.381Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"
        },
        {
          "name": "https://github.com/FasterXML/jackson-databind/issues/5981",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/5981"
        },
        {
          "name": "https://github.com/FasterXML/jackson-databind/issues/5983",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/5983"
        },
        {
          "name": "https://github.com/FasterXML/jackson-databind/pull/5984",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/pull/5984"
        },
        {
          "name": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"
        },
        {
          "name": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"
        }
      ],
      "source": {
        "advisory": "GHSA-rmj7-2vxq-3g9f",
        "discovery": "UNKNOWN"
      },
      "title": "jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54513",
    "datePublished": "2026-06-23T20:53:52.543Z",
    "dateReserved": "2026-06-15T18:01:15.514Z",
    "dateUpdated": "2026-07-21T12:05:18.406Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:40895

CVE-2026-54512 (GCVE-0-2026-54512)

CVE-2026-54513 (GCVE-0-2026-54513)

Tags

Sightings

Nomenclature