8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54512

CVE-2026-54512: jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54512

CVE-2026-54512:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.fasterxml.jackson.core:jackson-databind	maven	>= 2.10.0, <= 2.18.7	2.18.8
com.fasterxml.jackson.core:jackson-databind	maven	>= 3.0.0, <= 3.1.3	3.1.4
com.fasterxml.jackson.core:jackson-databind	maven	>= 2.19.0, <= 2.21.3	2.21.4
tools.jackson.core:jackson-databind	maven	>= 3.0.0, <= 3.1.3	3.1.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a bypass of the PolymorphicTypeValidator (PTV) in jackson-databind, which is used to prevent deserialization of untrusted data. The analysis of the patch reveals two key weaknesses that contribute to this bypass.

The primary issue lies in the com.fasterxml.jackson.databind.DatabindContext._resolveAndValidateGeneric method. Before the fix, this method would only validate the top-level class of a generic type string. For a type like java.util.ArrayList<com.evil.Gadget>, it would correctly validate java.util.ArrayList against the PTV, but it would completely ignore the com.evil.Gadget type parameter. The patch rectifies this by introducing a new recursive helper method, _validateTypeParameter, which is called to validate each generic type parameter and array element type, ensuring all parts of the type signature are checked against the PTV.

Secondly, a related flaw existed in com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator.validateSubType. This method did not correctly apply name-based PTV rules (e.g., allowIfSubType("com.example.")) to the element types of arrays. This meant that even if the validation was called for an array's element type, it would fail to apply the intended name-based policies. The patch corrects this by explicitly calling validateSubClassName for the array's element type, ensuring name-based rules are enforced.

An attacker can exploit these flaws by crafting a JSON payload with a malicious type identifier. This identifier would use an allowed class (like java.util.ArrayList) as a container for a denied gadget class, either as a generic type parameter or as an array element type. This would bypass the PTV checks, leading to the deserialization and instantiation of the malicious gadget, which could result in arbitrary code execution.

Vulnerable functions

com.fasterxml.jackson.databind.DatabindContext._resolveAndValidateGeneric

src/main/java/com/fasterxml/jackson/databind/DatabindContext.java

This function was vulnerable because it only validated the main container type of a generic type string against the PolymorphicTypeValidator (PTV). It did not validate the generic type parameters. An attacker could provide a malicious type as a parameter to an allowed container type (e.g., `java.util.ArrayList<com.evil.Gadget>`), bypassing the PTV and leading to the instantiation of the malicious type.

com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator.validateSubType

src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java

This function was vulnerable because when validating an array type, it failed to apply name-based validation rules to the array's element type. It only consulted class-based matchers. This allowed an attacker to bypass a name-prefix-based allow-list by using an array of a gadget class (e.g., `com.evil.Gadget[]`) as a type parameter.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.