Polymorphic Deserialization Vulnerability in Jackson Databind
CVE-2026-54512
What is CVE-2026-54512?
A vulnerability exists in Jackson Databind due to inadequate validation of nested type arguments during polymorphic deserialization. This issue arises when polymorphic typing is enabled, and type identifiers include generic parameters. The system only validates the raw container class name against the configured PolymorphicTypeValidator (PTV), allowing an attacker to craft malicious JSON that can instantiate a disallowed class type as a generic parameter within an allowed container. Consequently, this bypasses the PTV allow-list, leading to potential unauthorized access and manipulation of application data. The vulnerability has been rectified in versions 2.18.8, 2.21.4, and 3.1.4.
Affected Version(s)
jackson-databind >= 2.10.0, < 2.18.8 < 2.10.0, 2.18.8
jackson-databind >= 2.19.0, < 2.21.4 < 2.19.0, 2.21.4
jackson-databind >= 3.0.0, < 3.1.4 < 3.0.0, 3.1.4