{"id":"GHSA-rmj7-2vxq-3g9f","summary":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)","details":"## Summary\n`BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without validating the array's component (element) type against the configured allowlist. A PTV built with `allowIfSubTypeIsArray()` plus an explicit concrete-type allowlist therefore still permits `EvilType[]` even though `EvilType` is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist.\n\n## Impact\nApplications using `BasicPolymorphicTypeValidator` with `allowIfSubTypeIsArray()` as a safeguard get no protection for concrete array component types; an attacker controlling JSON can instantiate non-allowlisted types via an array wrapper, re-opening the gadget-instantiation risk PTV is meant to prevent.\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.18 line: `\u003e= 2.10.0, \u003c 2.18.8` -\u003e fixed in **2.18.8**\n- 2.19-2.21 line: `\u003e= 2.19.0, \u003c 2.21.4` -\u003e fixed in **2.21.4**\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4**\n\n`PolymorphicTypeValidator` was added in 2.10.0 so vulnerability N/A for versions prior to that.\n\n## Severity / CWE\nMaintainer: significant. Reporter: HIGH. CWE-184 (Incomplete List of Disallowed Inputs); related CWE-502.\n\n## Upstream fix\nFasterXML/jackson-databind#5981; fix PR #5983 (`24529da`), 2.18 backport PR #5984 (`01d1692`). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","aliases":["CVE-2026-54513"],"modified":"2026-09-11T15:45:04.961308294Z","published":"2026-06-23T21:22:15Z","database_specific":{"github_reviewed_at":"2026-06-23T21:22:15Z","nvd_published_at":"2026-06-23T21:17:02Z","cwe_ids":["CWE-184"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/issues/5983"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/issues/5981"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/pull/5984"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:50849"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:54622"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-54513"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492010"},{"type":"PACKAGE","url":"https://github.com/FasterXML/jackson-databind"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:36839"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:40895"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:43218"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:43400"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44061"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44062"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44063"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44064"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44065"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44066"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44271"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:48095"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:48151"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:50846"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:50847"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:50848"}],"affected":[{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.18.8"}]}],"versions":["2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.18.1","2.18.2","2.18.3","2.18.4","2.18.5","2.18.6","2.18.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json"}},{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.4"}]}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json"}},{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json"}},{"package":{"name":"tools.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}