CVE-2026-54513

What it actually does

The flaw is a polymorphic deserialization allowlist bypass in Jackson Databind. Applications that configure BasicPolymorphicTypeValidator with allowIfSubTypeIsArray() may unintentionally allow any array type because validation checks only whether the requested type is an array and does not validate the array component type. An attacker who can supply data to a Jackson polymorphic deserialization path may specify an array of a non-allowlisted class; when elements are deserialized without per-element type identifiers, Jackson can instantiate the component type directly without an additional polymorphic type validator check. Depending on the reachable classes, constructors, setters, and gadget-like behavior on the application classpath, this can lead to unauthorized object creation, data exposure, state manipulation, denial of service, or potentially code execution in high-risk applications.

Why it matters to the business

If an exposed service accepts untrusted JSON or other Jackson-supported input into affected polymorphic deserialization code, attackers may be able to bypass intended type restrictions and trigger unexpected application behavior. The operational impact can include service compromise, data theft or tampering, outages, and emergency patching of Java services that rely on Jackson Databind. Although this issue is not currently listed in CISA KEV and has low EPSS at this time, the CVSS severity is high and Jackson is widely used across Java ecosystems, so vulnerable patterns should be identified and remediated proactively.

How an attack unfolds

An attacker first identifies an endpoint, message consumer, API, job processor, or file import workflow that deserializes attacker-controlled content with Jackson polymorphic typing enabled. The vulnerable application must use an affected Jackson Databind version and a BasicPolymorphicTypeValidator configuration that includes allowIfSubTypeIsArray() along with an allowlist that was intended to restrict concrete subtypes. The attacker crafts serialized input that declares an array type whose component type is not actually allowlisted, such as a malicious or dangerous class present on the application classpath. Because the validator accepts the type based on the outer array property, Jackson proceeds to deserialize array elements and may instantiate the component type without re-checking it against the intended allowlist. The attacker then uses side effects from constructors, setters, lifecycle methods, or known gadget-like classes to disclose data, alter application state, consume resources, or, in the worst case, achieve remote code execution if a suitable gadget chain and execution conditions exist.

How to fix it

Upgrade Jackson Databind to a fixed version: 2.18.8, 2.21.4, 3.1.4, or later in the applicable release line. Ensure dependency management updates all transitive Jackson components consistently where possible, including jackson-databind, jackson-core, and jackson-annotations. If immediate upgrade is not possible, remove or avoid BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() for untrusted data paths, explicitly validate array component types before deserialization, avoid default typing for externally supplied input, and prefer schema-bound DTOs without polymorphic type metadata. Restrict dangerous classes from application classpaths where feasible, apply input size limits and request filtering, and isolate deserialization workloads with least privilege to reduce blast radius.

How to confirm the fix worked

Confirm the deployed jackson-databind version is 2.18.8, 2.21.4, 3.1.4, or later, depending on the release train in use. Use build tools such as Maven dependency:tree, Gradle dependencies, SCA tooling, container image scanners, and runtime classpath inspection to verify there are no older jackson-databind JARs packaged in applications, plugins, shaded libraries, or application server shared libraries. Review source code and configuration for BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() and polymorphic deserialization of untrusted data. Where safe, add regression tests that attempt to deserialize an array whose component type is not allowlisted and verify deserialization is rejected. Validate externally exposed endpoints and asynchronous consumers that accept JSON-like payloads do not allow arbitrary polymorphic type identifiers.

Typical attack path

1. Find a Java application endpoint, queue consumer, webhook, file upload, or internal API that accepts attacker-controlled serialized data processed by Jackson.
2. Confirm or infer that polymorphic deserialization is enabled and that the application uses Jackson Databind versions from 2.10.0 before 2.18.8, before 2.21.4, or before 3.1.4.
3. Identify that the BasicPolymorphicTypeValidator configuration uses allowIfSubTypeIsArray() together with explicit allowed concrete types.
4. Craft input that declares an array type whose component class is not in the intended allowlist but is present on the target classpath.
5. Send the crafted payload so the outer array type passes validation while the non-allowlisted element type is instantiated without a further validator check.
6. Trigger useful side effects from the instantiated class, such as sensitive data access, state changes, resource exhaustion, or gadget-chain execution where available.

How to detect it

Detection should focus on applications that deserialize untrusted input with Jackson and log request bodies, deserialization failures, or exception traces. Review application logs, API gateway logs, WAF logs, message broker payload audit logs, and error monitoring systems for suspicious Jackson polymorphic type metadata, especially payloads that declare array types or reference unexpected Java classes. Look for bursts of HTTP 400/500 responses, JsonMappingException, InvalidTypeIdException, MismatchedInputException, IllegalArgumentException, ClassNotFoundException, or stack traces involving BasicPolymorphicTypeValidator, TypeDeserializer, ObjectMapper, and ArrayType. Investigate requests containing Jackson type markers such as @class, @type, @JsonTypeInfo-style wrapper arrays, or fully qualified Java class names that are unrelated to the expected API schema. Because successful exploitation may leave only application-specific side effects, correlate suspicious deserialization activity with new outbound network connections, spawned child processes from Java, unexpected file writes, configuration changes, authentication anomalies, and service crashes. No named threat actors or ransomware campaigns are currently associated with this CVE in the provided data.

• allowIfSubTypeIsArray
• BasicPolymorphicTypeValidator
• com.fasterxml.jackson.databind.JsonMappingException
• com.fasterxml.jackson.databind.exc.InvalidTypeIdException
• com.fasterxml.jackson.databind.exc.MismatchedInputException
• com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator
• com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase
• com.fasterxml.jackson.databind.ObjectMapper
• @class
• @type
• java.lang.ClassNotFoundException
• Could not resolve type id
• missing type id property
• not a subtype
• Unexpected token
• START_ARRAY
• jackson-databind-2.10.
• jackson-databind-2.11.
• jackson-databind-2.12.
• jackson-databind-2.13.
• jackson-databind-2.14.
• jackson-databind-2.15.
• jackson-databind-2.16.
• jackson-databind-2.17.
• jackson-databind-2.18.0
• jackson-databind-2.18.1
• jackson-databind-2.18.2
• jackson-databind-2.18.3
• jackson-databind-2.18.4
• jackson-databind-2.18.5
• jackson-databind-2.18.6
• jackson-databind-2.18.7
• jackson-databind-2.21.0
• jackson-databind-2.21.1
• jackson-databind-2.21.2
• jackson-databind-2.21.3
• jackson-databind-3.1.0
• jackson-databind-3.1.1
• jackson-databind-3.1.2
• jackson-databind-3.1.3

What your security team should do

• Prioritize inventory of Java services and libraries using jackson-databind versions affected by this flaw, especially internet-facing APIs, webhook receivers, message consumers, and file import services.
• Upgrade affected applications to jackson-databind 2.18.8, 2.21.4, 3.1.4, or later, and redeploy images or packages that bundle older transitive copies.
• Search code repositories for allowIfSubTypeIsArray(), activateDefaultTyping, enableDefaultTyping, @JsonTypeInfo, and custom BasicPolymorphicTypeValidator configurations on untrusted input paths.
• Treat vulnerable polymorphic deserialization paths as high risk even though public exploit maturity is currently reported as none and EPSS is low.
• Add tests or security controls that reject untrusted payloads containing unexpected Jackson type metadata or non-allowlisted array component classes.
• Review logs for deserialization exceptions, unusual type identifiers, repeated malformed JSON submissions, and suspicious requests to endpoints that perform object binding.
• If exploitation is suspected, preserve application logs, request bodies where legally and operationally available, container images, dependency manifests, and JVM process evidence for forensic review.