Skip to content
Fencer Vulns
high 8.1

CVE-2026-54512 json

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

published 2026-06-23 4 mo ago modified 2026-10-28 11 d ago also GHSA-j3rv-43j4-c7qm , EUVD-2026-38595

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Patch / fix

  • maven com.fasterxml.jackson.core:jackson-databind 2.18.8, 2.21.4, 3.1.4
  • maven tools.jackson.core:jackson-databind 3.1.4
  • fasterxml jackson-databind 2.18.8, 2.21.4, 3.1.4
  • jackson-databind Debian 14 2.18.11-1

debian advisories DEBIAN-CVE-2026-54512

  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
  • eap8-jaxb jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-txw2 jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap

red hat advisories RHSA-2026:76129RHSA-2026:76130RHSA-2026:76128RHSA-2026:70230RHSA-2026:70229RHSA-2026:70228

  • jackson-core SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.22.3
  • jackson-databind SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.28.2
  • jackson-annotations SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.22.3
  • jackson-dataformats-binary SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.8-150200.3.21.3
  • jackson-databind SLES for SAP applications 16.0, SLES 16.0 2.18.8-160000.1.1
  • jackson-core SLES for SAP applications 16.0, SLES 16.0 2.18.8-160000.1.1
  • jackson-annotations SLES for SAP applications 16.0, SLES 16.0 2.18.8-160000.1.1

suse advisories SUSE-SU-2026:2801-1SUSE-SU-2026:22504-1

  • jackson-databind openSUSE Leap 16.0 2.18.8-160000.1.1
  • jackson-core openSUSE Leap 16.0 2.18.8-160000.1.1
  • jackson-annotations openSUSE Leap 16.0 2.18.8-160000.1.1
  • jackson-databind openSUSE Tumbleweed 2.18.8-2.1

opensuse advisories openSUSE-SU-2026:21201-1openSUSE-SU-2026:11132-1

  • idm-pki-ca AlmaLinux 10 11.9.0-4.el10_2.alma.1
  • idm-pki-kra AlmaLinux 10 11.9.0-4.el10_2.alma.1
  • idm-pki-acme AlmaLinux 10 11.9.0-4.el10_2.alma.1
  • idm-pki-base AlmaLinux 10 11.9.0-4.el10_2.alma.1
  • idm-pki-java AlmaLinux 10 11.9.0-4.el10_2.alma.1
  • idm-pki-tools AlmaLinux 10 11.9.0-4.el10_2.alma.1
  • idm-pki-server AlmaLinux 10 11.9.0-4.el10_2.alma.1
  • python3-idm-pki AlmaLinux 10 11.9.0-4.el10_2.alma.1

almalinux advisories ALSA-2026:43400ALSA-2026:40895

  • dogtag-pki Rocky Linux 10 11.9.0-4.el10_2.rocky.0.1
  • jackson-modules-base Rocky Linux 9 2.21.4-1.el9_8
  • jackson-core Rocky Linux 9 2.21.4-1.el9_8
  • jackson-databind Rocky Linux 9 2.21.4-1.el9_8
  • jackson-annotations Rocky Linux 9 2.21-1.el9_8
  • jackson-jaxrs-providers Rocky Linux 9 2.21.4-1.el9_8

rocky linux advisories RLSA-2026:43400RLSA-2026:40895

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54512 updated cvss 8.1

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

  • Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, +4 more
    affected: workaround, no fix available
  • Red Hat AI Inference Server rhaii/vllm-gaudi-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apache Camel - HawtIO 4 jackson-databind Red Hat build of Apache Camel 4 for Quarkus 3 jackson-databind
    affected: workaround, no fix available
  • Red Hat build of Debezium 3 jackson-databind
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 7 liborc1 Red Hat Ceph Storage 8 liborc1 Red Hat Ceph Storage 9 liborc, liborc2, libarrow, parquet-libs
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Certificate System 11 redhat-pki Red Hat Enterprise Linux 8 jackson-databind, jackson-databind-javadoc
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Fuse 7 jackson-databind
    affected: workaround, no fix available “Fix deferred”
show 27 more
  • Red Hat JBoss Enterprise Application Platform 7 jackson-databind
    affected: workaround, no fix available
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9, rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9, +6 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Satellite 6 puppetserver
    affected: workaround, no fix available
  • Red Hat AMQ Clients 2026.Q3
    fixed: vendor fix RHSA-2026:69459
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-13, cryostat/jfr-datasource-rhel9 4.2.0-13, cryostat/cryostat-reports-rhel9 4.2.0-13
    fixed: vendor fix RHSA-2026:48151
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-85
    fixed: vendor fix RHSA-2026:76134
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1786628667
    fixed: vendor fix RHSA-2026:60247
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1786628681
    fixed: vendor fix RHSA-2026:60249
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1786533561
    fixed: vendor fix RHSA-2026:60248
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1786533565
    fixed: vendor fix RHSA-2026:60239
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1787125166
    fixed: vendor fix RHSA-2026:60251
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1787124635
    fixed: vendor fix RHSA-2026:60246
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1787125069
    fixed: vendor fix RHSA-2026:60250
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1787124632
    fixed: vendor fix RHSA-2026:60252
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1787124925
    fixed: vendor fix RHSA-2026:60259
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1787125311
    fixed: vendor fix RHSA-2026:60254
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1787124779
    fixed: vendor fix RHSA-2026:60256
  • Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1787860580
    fixed: vendor fix RHSA-2026:61627
  • Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1789582776
    fixed: vendor fix RHSA-2026:68699
  • Red Hat AMQ Broker 7.13.6
    fixed: vendor fix RHSA-2026:66545
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat Build of Apache Camel 3.33.2.SP2 jackson-databind 2.21.4.redhat-00002
    fixed: vendor fix RHSA-2026:36839
  • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
    fixed: vendor fix RHSA-2026:54622
  • Red Hat build of Apicurio Registry 3.3.3
    fixed: vendor fix RHSA-2026:76637
  • Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9 26.4-22, rhbk/keycloak-rhel9-operator 26.4-22, rhbk/keycloak-operator-bundle 26.4.14-1
    fixed: vendor fix RHSA-2026:50847
  • Red Hat build of Keycloak 26.4.14
    fixed: vendor fix RHSA-2026:50846
  • Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-11, rhbk/keycloak-rhel9-operator 26.6-11, rhbk/keycloak-operator-bundle 26.6.5-1
    fixed: vendor fix RHSA-2026:50849

39 more fixed, 38 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

1.07% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven com.fasterxml.jackson.core:jackson-databind
>=2.10.0, <2.18.8
>=3.0.0, <3.1.4
>=2.19.0, <2.21.4
2.18.8
3.1.4
2.21.4
maven tools.jackson.core:jackson-databind
>=3.0.0, <3.1.4
3.1.4

Affected products

  • FasterXML jackson-databind

Classification

Weakness
  • CWE-184 Incomplete List of Disallowed Inputs
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.