Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-06-23T20:56:36
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
2026-07-08T00:00:00Z
RHSA-2026:36839
jackson-databind
Red Hat Enterprise Linux 9
2026-07-16T00:00:00Z
RHSA-2026:40895
jackson-databind-0:2.21.4-1.el9_8
Cryostat 4
Affected
jackson-databind
OpenShift Developer Tools and Services
Affected
jenkins
OpenShift Developer Tools and Services
Affected
jenkins-2-plugins
OpenShift Developer Tools and Services
Affected
ocp-tools-4/jenkins-rhel8
OpenShift Developer Tools and Services
Affected
ocp-tools-4/jenkins-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-ekb-dispatcher-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-ekb-receiver-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Affected
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
Red Hat AI Inference Server
Affected
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Affected
rhaii/vllm-gaudi-rhel9
Red Hat AMQ Broker 7
Affected
jackson-databind
Red Hat AMQ Clients
Affected
jackson-databind
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Not affected
python3.11-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Not affected
python3.12-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Not affected
python3x-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Not affected
python-drools-jpy-jar
Red Hat build of Apache Camel 4 for Quarkus 3
Affected
jackson-databind
Red Hat build of Apache Camel for Spring Boot 4
Affected
jackson-databind
Red Hat build of Apache Camel - HawtIO 4
Affected
jackson-databind
Red Hat build of Apicurio Registry 3
Affected
jackson-databind
Red Hat build of Debezium 3
Will not fix
jackson-databind
Red Hat Build of Keycloak
Affected
jackson-databind
Red Hat Build of Keycloak
Affected
rhbk/keycloak-rhel9
Red Hat Build of Keycloak
Affected
rhbk/keycloak-rhel9-operator
Red Hat Build of Keycloak
Affected
rhbk-openshift-rhel9/rhbk-openshift-rhel9
Red Hat Build of Keycloak
Affected
rhbk-rhel9-operator/rhbk-rhel9-operator
Red Hat build of Quarkus
Affected
jackson-databind
Red Hat Certificate System 10
Affected
redhat-pki:10/redhat-pki
Red Hat Certificate System 11
Affected
redhat-pki
Red Hat Data Grid 8
Affected
jackson-databind
Red Hat Enterprise Linux 10
Affected
dogtag-pki
Red Hat Enterprise Linux 8
Not affected
pki-core
Red Hat Enterprise Linux 8
Affected
pki-deps:10.6/jackson-databind
Red Hat Enterprise Linux 9
Not affected
jackson-jaxrs-providers
Red Hat Enterprise Linux 9
Not affected
jackson-modules-base
Red Hat Enterprise Linux 9
Not affected
pki-core
Red Hat Enterprise Linux 9
Not affected
resteasy
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-gaudi-rhel9
Red Hat JBoss Enterprise Application Platform 7
Affected
eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Affected
eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Affected
eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Affected
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Affected
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Affected
jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 8
Affected
jackson-databind
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
jackson-databind
Red Hat JBoss Enterprise Application Platform Expansion Pack
Under investigation
jackson-databind-2.15.0.jar
Red Hat JBoss Enterprise Application Platform Expansion Pack
Under investigation
jackson-databind-2.15.0.module
Red Hat JBoss Enterprise Application Platform Expansion Pack
Under investigation
jackson-databind-nullable
Red Hat Lightspeed for Runtimes Operator
Affected
rh-lightspeed-runtimes/runtimes-agent-init-rhel9
Red Hat Offline Knowledge Portal
Not affected
offline-knowledge-portal/rhokp-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-modelmesh-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-spark-operator-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-trustyai-service-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/multicluster-redirector-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/pluginregistry-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/server-rhel9
Red Hat Satellite 6
Not affected
candlepin
Red Hat Satellite 6
Affected
openvox-server
Red Hat Satellite 6
Affected
puppetserver
Red Hat Satellite 6
Not affected
satellite:el8/candlepin
Red Hat Satellite 6
Affected
satellite:el8/puppetserver
Red Hat Single Sign-On 7
Affected
jackson-databind
streams for Apache Kafka 2
Affected
jackson-databind
streams for Apache Kafka 3
Affected
jackson-databind
https://www.cve.org/CVERecord?id=CVE-2026-54512
https://nvd.nist.gov/vuln/detail/CVE-2026-54512
https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5
https://github.com/FasterXML/jackson-databind/issues/5988
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm