jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Priority MEDIUM 40CWE-184Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 34 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01226 69th percentileScored 2026-11-07
Fix Partial jackson-databind (FasterXML): 2.18.8, 2.21.4, 3.1.4com.fasterxml.jackson.core:jackson-databind (Maven): 2.18.8, 2.21.4, 3.1.4+1 more productRed Hat: 31 advisoriesRed Hat: 34 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FasterXML | jackson-databind | 2.10.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.4 | 2.18.8, 2.21.4, 3.1.4 | Patch available | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.10.0 to before 2.18.8 | 2.18.8 | Patch available | GHSA-rmj7-2vxq-3g9f |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.19.0 to before 2.21.4 | 2.21.4 | Patch available | GHSA-rmj7-2vxq-3g9f |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 3.0.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-rmj7-2vxq-3g9f |
| — | tools.jackson.core:jackson-databind (Maven) | 3.0.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-rmj7-2vxq-3g9f |
- jackson-databind VendorFasterXML Affected 2.10.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.4 Fixed in 2.18.8, 2.21.4, 3.1.4 Patch available CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.10.0 to before 2.18.8 Fixed in 2.18.8 Patch available GHSA-rmj7-2vxq-3g9f
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.19.0 to before 2.21.4 Fixed in 2.21.4 Patch available GHSA-rmj7-2vxq-3g9f
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-rmj7-2vxq-3g9f
- tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-rmj7-2vxq-3g9f
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.10.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.4 | Vulnerable | FasterXML |
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.10.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.4 Vulnerable ·FasterXML
Remediation
- Fix · CNA jackson-databind (FasterXML) Fixed in 2.18.8, 2.21.4, 3.1.4
- Fix · GHSA-rmj7-2vxq-3g9f com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.18.8 Advisory →
- Fix · GHSA-rmj7-2vxq-3g9f com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.21.4 Advisory →
- Fix · GHSA-rmj7-2vxq-3g9f com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 3.1.4 Advisory →
- Fix · GHSA-rmj7-2vxq-3g9f tools.jackson.core:jackson-databind (Maven) Fixed in 3.1.4 Advisory →
Red Hat 31 advisories
- RHSA-2026:76637 Released 2026-10-06 · Red Hat rating ImportantApicurio Registry (container images) release and security update [ 3.3.3 GA ]
- Red Hat build of Apicurio Registry 3.3.3
- RHSA-2026:70277 Released 2026-09-22 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.8 security update
- Red Hat JBoss Enterprise Application Platform 8.1.8.GA com.fasterxml.jackson.core.jackson-core-2.18.9.redhat-00003.jar, com.fasterxml.jackson.core.jackson-databind-2.18.9.redhat-00003.jar, io.netty.netty-codec-4.1.136.Final-redhat-00001.jar +17
- RHSA-2026:70230 Released 2026-09-22 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.8 security update
- Red Hat JBoss EAP 8.1 for RHEL 10 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el10eap +47
Show 28 more Red Hat advisories
- RHSA-2026:70228 Released 2026-09-22 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.8 security update
- Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el8eap +47
- RHSA-2026:70229 Released 2026-09-22 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.8 security update
- Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el9eap +47
- RHSA-2026:69459 Released 2026-09-21 · Red Hat rating ImportantAMQ Clients 2026.Q3
- AMQ Clients 2026.Q3
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
- RHSA-2026:66488 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.14.1 release and security update
- Red Hat AMQ Broker 7.14.1
- RHSA-2026:62260 Released 2026-09-01 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.0 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
- RHSA-2026:54622 Released 2026-08-13 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18.3 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
- RHSA-2026:54435 Released 2026-08-12 · Red Hat rating ImportantStreams for Apache Kafka 3.2.1 release and security update
- Streams for Apache Kafka 3.2.1
- RHSA-2026:50849 Released 2026-08-05 · Red Hat rating ImportantRed Hat build of Keycloak 26.6.5 Images Security Update
- Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
- RHSA-2026:50847 Released 2026-08-05 · Red Hat rating ImportantRed Hat build of Keycloak 26.4.14 Images Security Update
- Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
- RHSA-2026:50846 Released 2026-08-05 · Red Hat rating ImportantRed Hat build of Keycloak 26.4.14 Security Update
- Red Hat build of Keycloak 26.4.14
- RHSA-2026:50848 Released 2026-08-05 · Red Hat rating ImportantRed Hat build of Keycloak 26.6.5 Security Update
- Red Hat build of Keycloak 26.6.5
- RHSA-2026:48151 Released 2026-07-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
- RHSA-2026:48095 Released 2026-07-29 · Red Hat rating ImportantRHCS 10.8 bug fix and enhancement update
- Red Hat Certificate System 10.8 for RHEL 8 jss-5.9.1-2.module+el8pki+24483+db4528cf.src::redhat-pki:10, ldapjdk-5.6.0-3.module+el8pki+24228+5326976e.src::redhat-pki:10, python3-redhat-pki-11.9.2-4.module+el8pki+24565+7517ad63.noarch::redhat-pki:10 +23
- RHSA-2026:44271 Released 2026-07-23 · Red Hat rating Importantdogtag-pki security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) dogtag-pki-11.6.0-2.el10_0, idm-pki-acme-11.6.0-2.el10_0, idm-pki-base-11.6.0-2.el10_0 +6
- RHSA-2026:44064 Released 2026-07-23 · Red Hat rating Importantjackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) jackson-databind-2.21.4-1.el9_6, pki-jackson-databind-2.21.4-1.el9_6
- RHSA-2026:44066 Released 2026-07-23 · Red Hat rating Importantpki-deps:10.6 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
- RHSA-2026:44065 Released 2026-07-23 · Red Hat rating Importantjackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) jackson-databind-2.21.4-1.el9_4, pki-jackson-databind-2.21.4-1.el9_4
- RHSA-2026:44061 Released 2026-07-23 · Red Hat rating Importantpki-deps:10.6 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
- RHSA-2026:44063 Released 2026-07-23 · Red Hat rating Importantjackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) jackson-databind-2.21.4-1.el9_2, pki-jackson-databind-2.21.4-1.el9_2
- RHSA-2026:44062 Released 2026-07-23 · Red Hat rating Importantpki-deps:10.6 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
- RHSA-2026:43400 Released 2026-07-22 · Red Hat rating Importantdogtag-pki security update
- Red Hat Enterprise Linux AppStream (v. 10) dogtag-pki-11.9.0-4.el10_2, idm-pki-acme-11.9.0-4.el10_2, idm-pki-base-11.9.0-4.el10_2 +6
- RHSA-2026:43218 Released 2026-07-22 · Red Hat rating Importantpki-deps:10.6 security update
- Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6 +47
- RHSA-2026:41951 Released 2026-07-20 · Red Hat rating ImportantRed Hat Data Grid 8.6.2 security update
- Red Hat Data Grid 8.6.2
- RHSA-2026:40895 Released 2026-07-16 · Red Hat rating Importantjackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
- Red Hat Enterprise Linux AppStream (v. 9) jackson-databind-2.21.4-1.el9_8, pki-jackson-databind-2.21.4-1.el9_8
- RHSA-2026:36839 Released 2026-07-08 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP2)
- Red Hat Build of Apache Camel 3.33.2.SP2 com.fasterxml.jackson.core.jackson-databind-2.21.4.redhat-00002.jar, io.micrometer.micrometer-core-1.16.6.redhat-00001.jar, org.apache.cxf.cxf-core-4.1.7.rhbac-redhat-00003.jar
- RHSA-2026:36013 Released 2026-07-08 · Red Hat rating ImportantRed Hat build of Quarkus 3.33.2.SP2 security update
- Red Hat build of Quarkus 3.33.2.SP2 com.fasterxml.jackson.core.jackson-databind-2.21.4.redhat-00002.jar, io.micrometer.micrometer-core-1.16.6.redhat-00001.jar, org.keycloak.keycloak-policy-enforcer-26.0.10.redhat-00001.jar
- RHSA-2026:36002 Released 2026-07-08 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.4.SP2 security update
- Red Hat build of Quarkus 3.27.4.SP2 com.fasterxml.jackson.core.jackson-databind-2.21.4.redhat-00002.jar, io.micrometer.micrometer-core-1.14.7.redhat-00002.jar, org.keycloak.keycloak-policy-enforcer-26.0.10.redhat-00001.jar
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix planned: Will not fix |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| AMQ Clients 2026.Q3 | Fixed | RHSA-2026:69459 |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:48151 |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat AMQ Broker 7.14.1 | Fixed | RHSA-2026:66488 |
| Red Hat Build of Apache Camel 3.33.2.SP2 | Fixed | RHSA-2026:36839 |
| Red Hat Certificate System 10.8 for RHEL 8 | Fixed | RHSA-2026:48095 |
| Red Hat Data Grid 8.6.2 | Fixed | RHSA-2026:41951 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:43400 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:43218 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:40895 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:44062 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:44061 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:44066 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:44063 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:44065 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:44271 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:44064 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:44062 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:44061 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:44066 |
| Red Hat JBoss EAP 8.1 for RHEL 10 | Fixed | RHSA-2026:70230 |
| Red Hat JBoss EAP 8.1 for RHEL 8 | Fixed | RHSA-2026:70228 |
| Red Hat JBoss EAP 8.1 for RHEL 9 | Fixed | RHSA-2026:70229 |
| Red Hat JBoss Enterprise Application Platform 8.1.8.GA | Fixed | RHSA-2026:70277 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:62260 |
| Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16 | Fixed | RHSA-2026:54622 |
| Red Hat build of Apicurio Registry 3.3.3 | Fixed | RHSA-2026:76637 |
| Red Hat build of Keycloak 26.4 | Fixed | RHSA-2026:50847 |
| Red Hat build of Keycloak 26.4.14 | Fixed | RHSA-2026:50846 |
| Red Hat build of Keycloak 26.6 | Fixed | RHSA-2026:50849 |
| Red Hat build of Keycloak 26.6.5 | Fixed | RHSA-2026:50848 |
| Red Hat build of Quarkus 3.27.4.SP2 | Fixed | RHSA-2026:36002 |
| Red Hat build of Quarkus 3.33.2.SP2 | Fixed | RHSA-2026:36013 |
| Streams for Apache Kafka 3.2.1 | Fixed | RHSA-2026:54435 |
Not affected: 22 products
- Cryostat 4 on RHEL 9
- OpenShift Developer Tools and Services
- OpenShift Serverless
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Apache Camel 3.33.2.SP2
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Enterprise Linux AppStream E4S (v.9.2)
- Red Hat Enterprise Linux AppStream E4S (v.9.4)
- Red Hat Enterprise Linux AppStream EUS (v.9.6)
- Red Hat JBoss Enterprise Application Platform 8.1.8.GA
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Lightspeed for Runtimes Operator
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat Satellite 6
- Red Hat build of Quarkus 3.27.4.SP2
- Red Hat build of Quarkus 3.33.2.SP2
- streams for Apache Kafka 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54513
- 2026-10-03 Alias added: GHSA-rmj7-2vxq-3g9f
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-09 Fix available: RHSA-2026:36013 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:36002 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:36839 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:76637 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:70277 · Red Hat
- 2026-10-09 Fix available: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat JBoss Enterprise Application Platform 8.1, Red Hat build of Apicurio Registry 3.3.3 +2 · Red Hat
- 2026-10-18 Fix available: Red Hat Build of Apache Camel 3.33.2.SP2 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-21 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.8.GA · Red Hat
- 2026-11-03 Affected versions changed · Red Hat
References
Patch 5
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f
- https://github.com/FasterXML/jackson-databind/issues/5983
- https://github.com/FasterXML/jackson-databind/pull/5984
- https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5
- https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e
Other 28
- https://github.com/FasterXML/jackson-databind/issues/5981
- https://access.redhat.com/errata/RHSA-2026:50849
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:54622
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/security/cve/CVE-2026-54513
- https://bugzilla.redhat.com/show_bug.cgi?id=2492010
- https://github.com/FasterXML/jackson-databind
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json
- https://access.redhat.com/errata/RHSA-2026:36839
- https://access.redhat.com/errata/RHSA-2026:40895
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:43218
- https://access.redhat.com/errata/RHSA-2026:43400
- https://access.redhat.com/errata/RHSA-2026:44061
- https://access.redhat.com/errata/RHSA-2026:44062
- https://access.redhat.com/errata/RHSA-2026:44063
- https://access.redhat.com/errata/RHSA-2026:44064
- https://access.redhat.com/errata/RHSA-2026:44065
- https://access.redhat.com/errata/RHSA-2026:44066
- https://access.redhat.com/errata/RHSA-2026:44271
- https://access.redhat.com/errata/RHSA-2026:48095
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:50846
- https://access.redhat.com/errata/RHSA-2026:50847
- https://access.redhat.com/errata/RHSA-2026:50848
More FasterXML Jackson-databind vulnerabilities
- TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
- TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2020-07095 FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI… CVSS 3.1CRITICAL 9.8
- TI-2026-39358 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation CVSS 3.1HIGH 8.1
- TI-2020-08560 A deserialization flaw was discovered in jackson-databind through 2.9.10.4. CVSS 3.1HIGH 8.1
- TI-2020-07635 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-54513 · CVE Program
- CVE-2026-54513 · NVD
- FIRST EPSS
- GHSA-rmj7-2vxq-3g9f · GitHub Advisory Database · CC BY 4.0
- CVE-2026-54513 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences