Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-06-23T20:53:52
jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-184
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.
This Important flaw in `jackson-databind` allows for a security bypass, enabling arbitrary code execution. The vulnerability arises from insufficient validation of array component types by `BasicPolymorphicTypeValidator`, which permits deserialization of unallowlisted types when processing untrusted input. This bypass of type validation can lead to a complete system compromise, affecting confidentiality, integrity, and availability in Red Hat products utilizing `jackson-databind` for data processing.
Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application’s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change.
As an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules.
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
2026-07-08T00:00:00Z
RHSA-2026:36839
jackson-databind
Red Hat Enterprise Linux 9
2026-07-16T00:00:00Z
RHSA-2026:40895
jackson-databind-0:2.21.4-1.el9_8
Cryostat 4
Affected
jackson-databind
OpenShift Developer Tools and Services
Under investigation
jenkins
OpenShift Developer Tools and Services
Under investigation
jenkins-2-plugins
OpenShift Developer Tools and Services
Under investigation
ocp-tools-4/jenkins-rhel8
OpenShift Developer Tools and Services
Under investigation
ocp-tools-4/jenkins-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-ekb-dispatcher-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-ekb-receiver-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
Red Hat AI Inference Server
Under investigation
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Under investigation
rhaii/vllm-gaudi-rhel9
Red Hat AMQ Broker 7
Affected
jackson-databind
Red Hat AMQ Clients
Affected
jackson-databind
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
python3.11-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Under investigation
python3.12-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Under investigation
python3x-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Under investigation
python-drools-jpy-jar
Red Hat build of Apache Camel 4 for Quarkus 3
Affected
jackson-databind
Red Hat build of Apache Camel for Spring Boot 4
Affected
jackson-databind
Red Hat build of Apache Camel - HawtIO 4
Affected
jackson-databind
Red Hat build of Apicurio Registry 3
Affected
jackson-databind
Red Hat build of Debezium 3
Will not fix
jackson-databind
Red Hat Build of Keycloak
Affected
jackson-databind
Red Hat Build of Keycloak
Affected
rhbk/keycloak-rhel9
Red Hat Build of Keycloak
Affected
rhbk/keycloak-rhel9-operator
Red Hat Build of Keycloak
Affected
rhbk-openshift-rhel9/rhbk-openshift-rhel9
Red Hat Build of Keycloak
Affected
rhbk-rhel9-operator/rhbk-rhel9-operator
Red Hat build of Quarkus
Fix deferred
jackson-databind
Red Hat Certificate System 10
Affected
redhat-pki:10/redhat-pki
Red Hat Data Grid 8
Affected
jackson-databind
Red Hat Enterprise Linux 10
Affected
dogtag-pki
Red Hat Enterprise Linux 8
Affected
pki-deps:10.6/jackson-databind
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-gaudi-rhel9
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 8
Affected
jackson-databind
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
jackson-databind
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
jackson-databind-2.15.0.jar
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
jackson-databind-2.15.0.module
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
jackson-databind-nullable
Red Hat Lightspeed for Runtimes Operator
Under investigation
rh-lightspeed-runtimes/runtimes-agent-init-rhel9
Red Hat Offline Knowledge Portal
Under investigation
offline-knowledge-portal/rhokp-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-modelmesh-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-spark-operator-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-trustyai-service-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/multicluster-redirector-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/pluginregistry-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/server-rhel9
Red Hat Satellite 6
Under investigation
candlepin
Red Hat Satellite 6
Under investigation
openvox-server
Red Hat Satellite 6
Under investigation
puppetserver
Red Hat Satellite 6
Under investigation
satellite-capsule:el8/puppetserver
Red Hat Satellite 6
Under investigation
satellite:el8/candlepin
Red Hat Single Sign-On 7
Fix deferred
jackson-databind
streams for Apache Kafka 2
Affected
jackson-databind
streams for Apache Kafka 3
Affected
jackson-databind
https://www.cve.org/CVERecord?id=CVE-2026-54513
https://nvd.nist.gov/vuln/detail/CVE-2026-54513
https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5
https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e
https://github.com/FasterXML/jackson-databind/issues/5981
https://github.com/FasterXML/jackson-databind/issues/5983
https://github.com/FasterXML/jackson-databind/pull/5984
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f