CVE Almanac
← All CVEs

CVE-2026-54513

HIGH 8.1

Published 2026-06-23 · Last modified 2026-06-30

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

ELEVATED IMPACT

Severe if exploited (CVSS 8.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.7%chance of exploitation in 30 days · 48th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

8.1CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Affected

Vendors Fasterxml Red Hat

Products Jackson Databind Red Hat Certificate System 10 Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9

Weakness (CWE)

  • CWE-184

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Technical & other

Sources: NVD · CVE.org · EPSS