CVE-2026-54513 Overview
CVE-2026-54513 is a polymorphic type validator (PTV) allowlist bypass in jackson-databind, the data-binding component of the Jackson Data Processor for Java. The flaw exists in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray(), which approves any array type using clazz.isArray() without validating the array's element type against the configured allowlist. Attackers can craft input containing arrays of disallowed classes to bypass deserialization restrictions. The issue affects versions from 2.10.0 up to (but not including) 2.18.8, 2.21.4, and 3.1.4.
Critical Impact
Attackers who supply attacker-controlled JSON to a Jackson deserializer using allowIfSubTypeIsArray() can instantiate non-allowlisted types, enabling unsafe deserialization and potential remote code execution.
Affected Products
- FasterXML jackson-databind 2.10.0 through 2.18.7
- FasterXML jackson-databind 2.19.x through 2.21.3
- FasterXML jackson-databind 3.0.x through 3.1.3
Discovery Timeline
- 2026-06-23 - CVE-2026-54513 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-54513
Vulnerability Analysis
The vulnerability sits in Jackson's polymorphic type handling. BasicPolymorphicTypeValidator lets applications define an allowlist of concrete classes that may be deserialized when polymorphic typing is enabled. The allowIfSubTypeIsArray() builder method approves any value whose Java type satisfies clazz.isArray(). The check never inspects the array's component type. An attacker can therefore wrap an arbitrary class as EvilType[] and pass the PTV gate. The vulnerability is classified under [CWE-184: Incomplete List of Disallowed Inputs].
Root Cause
The root cause is incomplete input validation in the array sub-type predicate. The builder treats "is array" as a sufficient condition rather than a structural precondition that still requires the element type to be validated. When Jackson then deserializes individual array elements and no per-element type identifier is present in the payload, it instantiates the declared component type directly. This second-stage instantiation skips the PTV entirely, completing the bypass.
Attack Vector
Exploitation requires an application that enables default typing or explicit polymorphic handling with a BasicPolymorphicTypeValidator built using allowIfSubTypeIsArray() and a concrete-type allowlist. The attacker submits JSON whose declared type is an array of a non-allowlisted class. Jackson approves the array, then constructs each element using the disallowed component type. Depending on which classes are reachable on the classpath, this can be chained into gadget-style attacks that achieve remote code execution, file disclosure, or service disruption.
No public proof-of-concept code has been released. Technical detail and remediation context are documented in the jackson-databind GHSA-rmj7-2vxq-3g9f advisory and the upstream pull request.
Detection Methods for CVE-2026-54513
Indicators of Compromise
- Application logs showing JsonMappingException or InvalidTypeIdException events tied to unexpected class instantiation during deserialization.
- JVM process spawning unusual child processes (shell, cmd.exe, curl, wget) shortly after handling JSON input.
- Outbound network connections from Java services to attacker-controlled endpoints immediately after API calls that accept JSON bodies.
Detection Strategies
- Inventory dependencies with a software composition analysis (SCA) tool and flag any jackson-databind version below 2.18.8, 2.21.4, or 3.1.4.
- Perform static code review for usages of BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() and validate that callers also constrain element types.
- Inspect JSON traffic for type discriminators such as @class, @type, or "[L..." array signatures referencing classes outside the application's expected schema.
Monitoring Recommendations
- Enable detailed deserialization logging in non-production to identify unusual class loads during polymorphic decoding.
- Forward Java application logs and process telemetry to a central data lake and alert on Java process lineage anomalies.
- Monitor egress traffic from API services for unexpected destinations following JSON ingest endpoints.
How to Mitigate CVE-2026-54513
Immediate Actions Required
- Upgrade jackson-databind to 2.18.8, 2.21.4, or 3.1.4 (or later) across all build manifests and container images.
- Audit every PTV configuration that calls allowIfSubTypeIsArray() and replace it with allowlist rules that validate the array's element type.
- Disable default typing where polymorphic deserialization is not strictly required.
Patch Information
The upstream fix is delivered in jackson-databind 2.18.8, 2.21.4, and 3.1.4. The patched logic validates the array component type against the configured allowlist before approving the array. Review the upstream fix commit and the follow-up commit for implementation detail.
Workarounds
- Remove allowIfSubTypeIsArray() from PTV builders and explicitly allowlist required array types by full class name.
- Switch to activateDefaultTypingAsProperty only with a strict, denylist-aware validator that rejects unknown component classes.
- Restrict the classpath of services that deserialize untrusted JSON to remove known deserialization gadget libraries.
# Configuration example: enforce patched versions via Maven enforcer
mvn versions:use-dep-version -Dincludes=com.fasterxml.jackson.core:jackson-databind -DdepVersion=2.18.8 -DforceVersion=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
