{"id":"CVE-2026-54513","summary":"jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)","details":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.","aliases":["GHSA-rmj7-2vxq-3g9f"],"modified":"2026-07-25T08:04:52.321785Z","published":"2026-06-23T20:53:52.543Z","related":["ALSA-2026:40895","ALSA-2026:43218","ALSA-2026:43400","SUSE-SU-2026:22504-1","SUSE-SU-2026:2801-1","openSUSE-SU-2026:11118-1","openSUSE-SU-2026:21201-1"],"database_specific":{"cwe_ids":["CWE-184"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54513.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36839"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40895"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43218"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43400"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44061"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44062"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44063"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44064"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44065"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44066"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44271"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-54513"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54513.json"},{"type":"ADVISORY","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492010"},{"type":"REPORT","url":"https://github.com/FasterXML/jackson-databind/issues/5981"},{"type":"REPORT","url":"https://github.com/FasterXML/jackson-databind/issues/5983"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/pull/5984"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fasterxml/jackson-databind","events":[{"introduced":"a1eedfdeea46f2a8da0ed23f06e7e1d39050499b"},{"fixed":"0b422144d1785200e44a0b00c973f6ac95adcf5a"},{"introduced":"f644a920f4ac768797edf7709070411837c83ef8"},{"fixed":"dd72fa6c89b5cea6c4eba5a8604f248bbc5d93e5"},{"introduced":"d51183e4fa171235bcd31c63268c5ad1745afb8c"},{"fixed":"0105ba7c8c7d2aa59707c458eeb6c27e77779734"},{"fixed":"01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"},{"fixed":"24529da29fdf46ff94ca38de9ebf31cd188f5e8e"}],"database_specific":{"cpe":"cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.10.0"},{"fixed":"2.18.8"},{"introduced":"2.19.0"},{"fixed":"2.21.4"},{"introduced":"3.0.0"},{"fixed":"3.1.4"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["jackson-databind-3.1.3","jackson-databind-2.21.3","jackson-databind-2.18.7","jackson-databind-3.1.2","jackson-databind-3.1.1","jackson-databind-2.21.2","jackson-databind-3.1.0","jackson-databind-2.21.1","jackson-databind-2.18.6","jackson-databind-3.1.0-rc1","jackson-databind-2.21.0","jackson-databind-2.18.5","jackson-databind-3.0.1","jackson-databind-3.0.0","jackson-databind-2.20.0","jackson-databind-2.20.0-rc1","jackson-databind-2.18.4","jackson-databind-2.19.0","jackson-databind-2.18.3","jackson-databind-2.18.2","jackson-databind-2.18.1","jackson-databind-2.18.0","jackson-databind-2.18.0-rc1","jackson-databind-2.17.0-rc1","jackson-databind-2.16.0","jackson-databind-2.16.0-rc1","jackson-databind-2.15.0","jackson-databind-2.15.0-rc3","jackson-databind-2.15.0-rc2","jackson-databind-2.15.0-rc1","jackson-databind-2.14.0","jackson-databind-2.14.0-rc3","jackson-databind-2.14.0-rc2","jackson-databind-2.14.0-rc1","jackson-databind-2.13.0","jackson-databind-2.13.0-rc2","jackson-databind-2.13.0-rc1","jackson-databind-2.12.1","jackson-databind-2.12.0","jackson-databind-2.12.0-rc2","jackson-databind-2.12.0-rc1","jackson-databind-2.11.0","jackson-databind-2.11.0.rc1","jackson-databind-2.10.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","target":{"file":"src/main/java/tools/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java","function":"allowIfSubTypeIsArray"},"deprecated":false,"digest":{"function_hash":"248972036414687396055322000765373650039","length":175},"id":"CVE-2026-54513-496cc382"},{"digest":{"threshold":0.9,"line_hashes":["222215740526239670890085528756438738476","331295683154341241710347518365063774713","308784427221242271214883173873242602113","286005296642661651573924881594540503877","52306734999155809351700230008238141121","7717806449009989375406862764686975413","337380183345182492182004069093334076142","219234520932058309156763209852731523097","289859187067076519920256762480453639556","223442965775651307273058716989534464532","20642817604511906644384966996141132886","17082743701711854939180623376945802125","186472944678391693417335342053955183487","175637255300502824706367093259756863769","325694705429310997539917568464694543958","7113080116449884024418468646178333935","168030344669334103713087741826229750202","113633566319938967783367531899542729471","263695080421886459886540643611423279623","68722282626767908683495593139615605191","332337986067972162882079784941397482537","156516254727550566570175724482739626532","243079986969890431297821406565534853089","241596089959942130995542634157203192638","79144889035049365096060890953572074326","328652041900857598718612637125682420521","336505484416621083516861007302983820242","329200403928959141836822019326826617998","223215416715146286887892452721560251192","172494011110432854100072220923882314103","154322532942066725329718377513713106982","201807181764638010124683684072626271224","292949127103408528864473335493290325647","273717542131142875851275124578696502219","319249942997354713258688939934278933196","257265378816997228955455844569879170","39960419926522273401940405633852594899","55570651807088303111379872983522009202"]},"id":"CVE-2026-54513-6e693f5b","signature_type":"Line","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","target":{"file":"src/main/java/tools/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java"},"deprecated":false},{"id":"CVE-2026-54513-7096732d","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","target":{"file":"src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java","function":"match"},"deprecated":false,"digest":{"function_hash":"1929955398536373805100777210583298525","length":78}},{"id":"CVE-2026-54513-83661af6","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","target":{"file":"src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java","function":"allowIfSubTypeIsArray"},"deprecated":false,"digest":{"function_hash":"224021050390728249120098062137549555749","length":180}},{"source":"https://github.com/fasterxml/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","target":{"file":"src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java","function":"validateSubType"},"deprecated":false,"digest":{"function_hash":"96746149866221518538181062838651343131","length":304},"id":"CVE-2026-54513-85952890","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java","function":"build"},"deprecated":false,"digest":{"function_hash":"238017751914883436877789925871765643875","length":356},"id":"CVE-2026-54513-ad33b491","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"},{"source":"https://github.com/fasterxml/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","target":{"file":"src/main/java/tools/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java","function":"validateSubType"},"deprecated":false,"digest":{"function_hash":"267268652595347189837908975613484972954","length":276},"id":"CVE-2026-54513-b105aa14","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"118988210987672080680194997427056694547","length":185},"id":"CVE-2026-54513-b29276ee","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","target":{"file":"src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java","function":"BasicPolymorphicTypeValidator"}},{"deprecated":false,"digest":{"function_hash":"118988210987672080680194997427056694547","length":185},"id":"CVE-2026-54513-cc3e2093","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","target":{"file":"src/main/java/tools/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java","function":"BasicPolymorphicTypeValidator"}},{"deprecated":false,"digest":{"function_hash":"238017751914883436877789925871765643875","length":356},"id":"CVE-2026-54513-d0f20a16","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","target":{"file":"src/main/java/tools/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java","function":"build"}},{"deprecated":false,"digest":{"line_hashes":["48310970054272332933605026324965339861","183789564208877505709578669530358305100","19157562644835592993914264011508579105","236434514890418416852293894250334320786","52306734999155809351700230008238141121","7717806449009989375406862764686975413","337380183345182492182004069093334076142","289859187067076519920256762480453639556","223442965775651307273058716989534464532","20642817604511906644384966996141132886","62686194757718263181701814773168035248","59196816312455379313485730363022490532","303763001037767533693143845751608645908","87520529005505984690361538587849280772","7113080116449884024418468646178333935","167675610096949671236877816489850037596","225835755253815487940598454990651564806","263695080421886459886540643611423279623","68722282626767908683495593139615605191","332337986067972162882079784941397482537","156516254727550566570175724482739626532","243079986969890431297821406565534853089","241596089959942130995542634157203192638","79144889035049365096060890953572074326","328652041900857598718612637125682420521","336505484416621083516861007302983820242","329200403928959141836822019326826617998","223215416715146286887892452721560251192","172494011110432854100072220923882314103","154322532942066725329718377513713106982","201807181764638010124683684072626271224","70001397735422217569834951277175686656","333177176893441918071103409245441627850","257265378816997228955455844569879170","39960419926522273401940405633852594899","55570651807088303111379872983522009202"],"threshold":0.9},"id":"CVE-2026-54513-d6a20634","signature_type":"Line","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","target":{"file":"src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java"}},{"target":{"function":"match","file":"src/main/java/tools/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java"},"deprecated":false,"digest":{"function_hash":"1929955398536373805100777210583298525","length":78},"id":"CVE-2026-54513-e413075e","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-54513.json","vanir_signatures_modified":"2026-07-25T08:04:52Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}