CVE-2026-54512 Overview
CVE-2026-54512 is a deserialization vulnerability in jackson-databind, the data-binding library for the Jackson Data Processor. The flaw allows attackers to bypass the PolymorphicTypeValidator (PTV) allow-list by embedding denied classes as generic type parameters of permitted container types. When polymorphic typing is enabled, the library validates only the raw container class name and ignores nested type arguments. An attacker who controls the type identifier can trigger instantiation of arbitrary classes through Jackson's polymorphic deserialization path. The issue affects versions from 2.10.0 through 2.18.7, 2.21.3, and 3.1.3, and is fixed in 2.18.8, 2.21.4, and 3.1.4.
Critical Impact
Attackers can bypass an explicitly configured PolymorphicTypeValidator allow-list, leading to instantiation of attacker-chosen classes and potential gadget chain execution during JSON deserialization.
Affected Products
- jackson-databind versions 2.10.0 through 2.18.7
- jackson-databind versions 2.19.x through 2.21.3
- jackson-databind versions 3.0.x through 3.1.3
Discovery Timeline
- 2026-06-23 - CVE CVE-2026-54512 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-54512
Vulnerability Analysis
The vulnerability resides in DatabindContext._resolveAndValidateGeneric(). When a type identifier contains generic parameters denoted by <, the method extracts the substring before < as the raw container class name and validates only that name against the configured PTV. If the container class passes validation, the method calls TypeFactory.constructFromCanonical() on the full canonical type string and returns a fully parameterized type. The nested type arguments are never re-validated against the PTV. Jackson then resolves, instantiates, and populates those nested types as beans during deserialization, weaponizing the trust boundary that the PTV was designed to enforce. This places the issue squarely in the insecure deserialization category and aligns with [CWE-184] improper validation logic.
Root Cause
The PTV check operates on the outer container name rather than on the full parsed type structure. _resolveAndValidateGeneric() assumes that approving the container is sufficient, but TypeFactory.constructFromCanonical() returns a composite JavaType whose parameter types can reference any class on the classpath. Validation is never reapplied to those parameter types before instantiation.
Attack Vector
An attacker who can influence the JSON payload supplies a type identifier such as java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes PTV validation. Jackson then resolves com.evil.Gadget through Class.forName(name, true, loader), instantiates it, and populates its fields from attacker-controlled JSON. If any reachable class on the classpath has dangerous side effects in its constructors or setters, the attacker achieves the impact of an unrestricted deserialization gadget chain. The attack requires network-reachable input to a deserialization endpoint that uses polymorphic typing.
No public proof-of-concept code is referenced in the advisory. See the GitHub Security Advisory GHSA-j3rv-43j4-c7qm and the upstream fix commit for technical details.
Detection Methods for CVE-2026-54512
Indicators of Compromise
- JSON payloads containing @class, @type, or other type identifier fields whose values include the < character followed by class names outside the configured allow-list.
- Unexpected Class.forName resolutions in application logs referencing classes that are not part of the application's data model.
- New child processes, network connections, or file writes originating from JVM threads handling HTTP request deserialization.
Detection Strategies
- Inspect inbound JSON for type identifiers containing generic syntax and compare nested class names against the PTV allow-list at the proxy or WAF layer.
- Audit application dependencies using software composition analysis to flag jackson-databind versions in the affected ranges.
- Enable Jackson debug or trace logging temporarily in non-production to surface parameterized type resolutions, then correlate against known-good types.
Monitoring Recommendations
- Alert on JVM processes spawning shells, scripting interpreters, or invoking java.lang.Runtime.exec from request-handling threads.
- Track outbound network connections from application servers to non-approved destinations following deserialization activity.
- Monitor classloading metrics for spikes in resolutions of classes outside the application's expected package set.
How to Mitigate CVE-2026-54512
Immediate Actions Required
- Upgrade jackson-databind to 2.18.8, 2.21.4, or 3.1.4 depending on the major version line in use.
- Inventory all services that enable polymorphic typing via ObjectMapper.activateDefaultTyping() or @JsonTypeInfo and prioritize them for patching.
- Where patching is delayed, disable default typing and remove polymorphic deserialization for untrusted inputs.
Patch Information
The fix is included in jackson-databind versions 2.18.8, 2.21.4, and 3.1.4. The patch updates DatabindContext._resolveAndValidateGeneric() to validate every nested type argument against the configured PolymorphicTypeValidator before instantiation. Review the upstream commit and issue #5988 for implementation specifics.
Workarounds
- Disable polymorphic typing entirely for endpoints that accept untrusted JSON.
- Implement a custom PolymorphicTypeValidator that rejects any type identifier containing the < character until the upgrade is complete.
- Restrict the classpath to remove known gadget libraries that are not required at runtime.
# Maven dependency upgrade example
mvn versions:use-dep-version -Dincludes=com.fasterxml.jackson.core:jackson-databind -DdepVersion=2.18.8 -DforceVersion=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
