Jackson-Databind PTV Array Type Allowlist Bypass 2.10.0-2.18.8, 2.21.4, 3.1.4
CVE-2026-54513 Published on June 23, 2026

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

NVD

Vulnerability Analysis

CVE-2026-54513 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Denylist / Deny List Vulnerability?

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. Developers often try to protect their products against malicious input by performing tests against inputs that are known to be bad, such as special characters that can invoke new commands. However, such lists often only account for the most well-known bad inputs. Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.

CVE-2026-54513 has been classified to as a Denylist / Deny List vulnerability or weakness.


Products Associated with CVE-2026-54513

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-54513 are published in these products:

FasterXML Jackson Databind
 
Red Hat Certificate System
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Quarkus
 
Red Hat Cryostat
 
Red Hat Amq Broker
 
Red Hat Amq Clients
 
Red Hat Apache Camel Hawtio
 
Red Hat Camel Quarkus
 
Red Hat Camel Spring Boot
 
Red Hat Apicurio Registry
 
Red Hat Debezium
 
Red Hat Build Keycloak
 
Red Hat Jboss Data Grid
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Single Sign On
 
Red Hat Amq Streams
 
Red Hat Ocp Tools
 
Red Hat Serverless
 
Red Hat Ai Inference Server
 
Red Hat Ansible Automation Platform
 
Red Hat Enterprise Linux Ai
 
Red Hat Lightspeed For Runtimes
 
Red Hat Offline Knowledge Portal
 
Red Hat Openshift Ai
 
Red Hat Openshift Devspaces
 
Red Hat Satellite
 
Red Hat Apache Camel Quarkus
 
Oracle
 
Red Hat Enterprise Linux Eus
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Red Hat Rhel Tus
 
Red Hat Rhel E4s
 
Red Hat Rhel Eus
 

Affected Versions

FasterXML jackson-databind: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33: Red Hat Data Grid 8.6.2: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: Red Hat Enterprise Linux 8.8 Telecommunications Update Service: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Cryostat 4: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat AI Inference Server: Red Hat AI Inference Server: Red Hat AMQ Broker 7: Red Hat AMQ Clients: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat build of Apache Camel 4 for Quarkus 3: Red Hat build of Apache Camel for Spring Boot 4: Red Hat build of Apache Camel - HawtIO 4: Red Hat build of Apicurio Registry 3: Red Hat build of Debezium 3: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat build of Quarkus: Red Hat Certificate System 10: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat Lightspeed for Runtimes Operator: Red Hat Offline Knowledge Portal: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Single Sign-On 7: Red Hat streams for Apache Kafka 2: Red Hat streams for Apache Kafka 3:

Exploit Probability

EPSS
0.71%
Percentile
49.84%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.