→

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54513

CVE-2026-54513:

8.1

CVSS Score

3.1

-

CVSS Score

-

Basic Information

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.fasterxml.jackson.core:jackson-databind	maven	>= 2.10.0, < 2.18.8	2.18.8
com.fasterxml.jackson.core:jackson-databind	maven	>= 2.19.0, < 2.21.4	2.21.4
com.fasterxml.jackson.core:jackson-databind	maven	>= 3.0.0, < 3.1.4	3.1.4
tools.jackson.core:jackson-databind	maven	>= 3.0.0, < 3.1.4	3.1.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in BasicPolymorphicTypeValidator and is caused by an incomplete check when array subtypes are allowed. The Builder.allowIfSubTypeIsArray() method originally added a rule that approved any class that is an array, without inspecting the array's element type. This created a security bypass.

During deserialization, the validateSubType method would use this rule and incorrectly approve a malicious type if it was wrapped in an array (e.g., EvilGadget[]). Jackson would then proceed to instantiate the elements of the array, bypassing the intended security validation and leading to the instantiation of non-allowlisted "gadget" types.

The patch rectifies this by modifying allowIfSubTypeIsArray() to simply set a flag. The validateSubType method is then enhanced to check for this flag. When the flag is active and an array type is encountered, validateSubType now recursively unwraps the array down to its innermost non-array element type and performs the validation against that element type. This ensures that the component type of an array is properly validated against the configured security policy, closing the vulnerability.

Vulnerable functions

com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray

src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java

This function was changed from adding a generic array matcher to setting a flag. The original implementation was vulnerable because it allowed any array type (`clazz.isArray()`) without validating the array's component (element) type. This allowed an attacker to bypass the allowlist by wrapping a non-allowlisted type in an array.

com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator.validateSubType

src/main/java/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java

This function is where the insecure rule from `allowIfSubTypeIsArray` was executed. Before the patch, it would receive an `ALLOWED` result for any array type from the matcher and would not perform further checks on the array's element type. The patch adds logic to this function to specifically handle array types: it unwraps the array to get the base element type and then validates that type against the existing subclass matchers, thus closing the bypass.

tools.jackson.databind.jsontype.BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray

src/main/java/tools/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java

This function was changed from adding a generic array matcher to setting a flag. The original implementation was vulnerable because it allowed any array type (`clazz.isArray()`) without validating the array's component (element) type. This allowed an attacker to bypass the allowlist by wrapping a non-allowlisted type in an array. This path is for jackson-databind 3.x.

tools.jackson.databind.jsontype.BasicPolymorphicTypeValidator.validateSubType

src/main/java/tools/jackson/databind/jsontype/BasicPolymorphicTypeValidator.java

This function is where the insecure rule from `allowIfSubTypeIsArray` was executed. Before the patch, it would receive an `ALLOWED` result for any array type from the matcher and would not perform further checks on the array's element type. The patch adds logic to this function to specifically handle array types: it unwraps the array to get the base element type and then validates that type against the existing subclass matchers, thus closing the bypass. This path is for jackson-databind 3.x.

Vulnerability Intelligence
Miggo AI

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

CVE-2026-54513:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

8.1

8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

CVE-2026-54513:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

8.1

8.1

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI