CVE-2026-54513: Jackson-databind Polymorphic Type Validator Array Bypass

Technical summary

The vulnerability exists in jackson-databind's BasicPolymorphicTypeValidator (PTV) implementation. The allowIfSubTypeIsArray() method uses only clazz.isArray() to approve array types without recursively validating the array's component type against the configured allowlist. During deserialization of array elements, when no per-element type ID is embedded in the payload, Jackson instantiates the component type directly, bypassing the PTV check entirely. This permits an attacker to instantiate blacklisted or unvetted types by delivering them as array elements, circumventing the polymorphic type filtering that the validator is intended to enforce.

Business impact

Applications relying on Jackson's polymorphic type validator as a security boundary for untrusted JSON/XML deserialization face object instantiation attacks. An attacker can deserialize malicious objects of restricted types, potentially leading to remote code execution if those types have dangerous constructors or setter methods. This is particularly severe in microservices and API-driven architectures where deserialization of external data is routine. The vulnerability undermines the security model developers rely on when configuring allowlists.

Affected systems

jackson-databind versions 2.10.0 through 2.18.7 (in the 2.18.x line), 2.21.0 through 2.21.3 (in the 2.21.x line), and 3.0.0 through 3.1.3 (in the 3.x line) are affected. Any application that: (1) uses BasicPolymorphicTypeValidator with allowIfSubTypeIsArray(), (2) deserializes untrusted polymorphic data, and (3) relies on the validator's allowlist to prevent instantiation of dangerous types, is vulnerable. Users of other PTV configurations or those not using polymorphic type validation are not affected.

Exploitability

Exploitation requires the application to accept untrusted serialized data (JSON, XML, YAML, etc.) and deserialize it using Jackson with a PTV configured via allowIfSubTypeIsArray(). The attacker supplies malicious objects as array elements within the trusted payload structure. The attack is network-accessible if deserialization occurs on externally-facing endpoints. However, the CVSS score of 8.1 reflects that AC:H (attack complexity high) is a factor—the attacker must understand the application's allowlist and identify gadget chains or dangerous types available on the classpath. No public exploit code is known at this time, and the vulnerability is not yet listed in the CISA KEV catalog.

Remediation

Upgrade to patched versions: jackson-databind 2.18.8, 2.21.4, or 3.1.4 or later, depending on your current line. If immediate patching is not feasible, audit your use of allowIfSubTypeIsArray() and consider restricting deserialization to a narrow set of explicitly required types, or disable polymorphic type handling if possible. Code review should identify all instances where BasicPolymorphicTypeValidator is instantiated and validate that the allowlist configuration matches your security policy.

Patch guidance

1. Identify your current jackson-databind version (check pom.xml, build.gradle, package.json, or equivalent for your ecosystem). 2. If on 2.10.x–2.18.x, update to 2.18.8 or later. If on 2.19.x–2.21.x, update to 2.21.4 or later. If on 3.0.x–3.1.x, update to 3.1.4 or later. 3. Verify against the vendor advisory that the version you select is confirmed patched. 4. Test deserialization pathways, particularly any that use allowIfSubTypeIsArray(), in a staging environment before production deployment. 5. Consider running a security regression test with intentionally malicious array payloads to confirm the fix is active.

Detection guidance

Monitor deserialization errors and type validation logs for sudden spikes in 'type not allowed' or similar rejections, which may indicate attack attempts. Use SAST tools to scan codebases for instantiations of BasicPolymorphicTypeValidator and allowIfSubTypeIsArray() calls; document and review each one. Network detection is difficult without custom signatures, but look for repeated requests to endpoints that accept JSON/XML with arrays of unexpected types. Implement logging that records both the allowlist configuration and the types actually encountered during deserialization to identify bypasses.

Why prioritize this

While not yet in the CISA KEV catalog, this vulnerability deserves immediate attention because: (1) it affects a widely-used library in Java and polyglot environments, (2) it directly bypasses a documented security control (the polymorphic type allowlist), (3) successful exploitation often leads to RCE, and (4) the flaw is subtle and not obvious to code reviewers, increasing the risk that vulnerable configurations exist in production systems. Organizations that practice secure deserialization patterns are at highest risk.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: Network-accessible vector (AV:N), high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), no user interaction required (UI:N), and unauthenticated access (PR:N/UI:N). The attack complexity is rated High (AC:H) because the attacker must understand the target's allowlist and identify suitable gadget chains. The score does not account for limited real-world prevalence of allowIfSubTypeIsArray() usage, but organizations that do use it face severe risk.

Frequently asked questions