Incomplete List of Disallowed Inputs in jackson-databind - CVE-2026-54513

Vulnerability identifier: #VU139158

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-54513

CWE-ID: CWE-184

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to instantiate non-allowlisted types.

The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.

The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.

jackson-databind
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Basesystem Module
Development Tools Module
Fedora
Netezza Appliance
Db2 Bridge
CICS Transaction Gateway Desktop Edition
WebSphere Automation
Crucible Server
Crucible Data Center
Crowd Data Center
IBM Sterling Connect:Direct Web Services
IBM Common Licensing
IBM Maximo Application Suite - Manage Component
Red Hat build of Quarkus
IBM SPSS Collaboration and Deployment Services
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
xsom
xsom-javadoc
xml-stylebook-javadoc
xml-stylebook-demo
xml-stylebook
bea-stax
bea-stax-api
bea-stax-javadoc
glassfish-fastinfoset
glassfish-fastinfoset-javadoc
xml-commons-resolver-javadoc
xml-commons-resolver
xml-commons-apis-manual
xml-commons-apis-javadoc
xml-commons-apis
xmlstreambuffer-javadoc
xmlstreambuffer
stax-ex-javadoc
stax-ex
velocity-manual
velocity-javadoc
velocity-demo
velocity
slf4j-javadoc
slf4j-ext
slf4j-jdk14
slf4j-jcl
slf4j-log4j12
slf4j
jcl-over-slf4j
jul-to-slf4j
log4j-over-slf4j
slf4j-sources
slf4j-manual
relaxngcc-javadoc
relaxngcc
glassfish-jax-rs-api-javadoc
glassfish-jax-rs-api
glassfish-jaxb-txw-parent
glassfish-jaxb-runtime-parent
glassfish-jaxb-runtime
glassfish-jaxb-rngom
glassfish-jaxb-parent
glassfish-jaxb-core
glassfish-jaxb-codemodel-parent
glassfish-jaxb-codemodel-annotation-compiler
glassfish-jaxb-codemodel
glassfish-jaxb-bom-ext
glassfish-jaxb-bom
glassfish-jaxb-txw2
glassfish-jaxb-external-parent
glassfish-jaxb
glassfish-jaxb-api
glassfish-jaxb-api-javadoc
apache-commons-lang-javadoc
apache-commons-lang
xalan-j2-manual
xalan-j2-xsltc
xalan-j2
xalan-j2-javadoc
xalan-j2-demo
xerces-j2
xerces-j2-demo
xerces-j2-javadoc
jackson-dataformat-cbor
jackson-core
jackson-annotations
jackson-databind
jackson-parent
jackson-annotations (Red Hat package)
jackson-jaxrs-providers-parent
jackson-jaxrs-providers-datatypes
jackson-jaxrs-providers
jackson-jaxrs-json-provider
jackson-bom
jackson-core (Red Hat package)
jackson-modules-base (Red Hat package)
jackson-jaxrs-providers (Red Hat package)
jackson-databind (Red Hat package)
jackson-module-jaxb-annotations
jackson-modules-base
resteasy
resteasy-javadoc
jakarta-commons-httpclient
jakarta-commons-httpclient-demo
jakarta-commons-httpclient-javadoc
jakarta-commons-httpclient-manual
apache-commons-collections-javadoc
apache-commons-collections
apache-commons-collections-testframework
apache-commons-net
apache-commons-net-javadoc
javassist-javadoc
javassist
pki-servlet-engine
dogtag-pki (Red Hat package)
fasterxml-oss-parent
relaxngDatatype-javadoc
relaxngDatatype
msv-xsdlib
msv-xmlgen
msv-rngconv
msv-msv
msv-demo
msv-javadoc
msv-manual
Red Hat Camel for Spring Boot
EntireX
JBoss Data Grid

Install security update from vendor's website.

jackson-databind - addressed in versions 2.18.8, 2.21.4, 3.1.4
Netezza Appliance - update to 1.0.2.0
Db2 Bridge - update to 1.1.5.1
WebSphere Automation - update to 1.13.0
Crucible Server - update to 4.9.13
Crucible Data Center - update to 4.9.13
Crowd Data Center - update to 7.2.2
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.20, 6.4.0.9
IBM Common Licensing - update to 9.1
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.28, 9.1.20, 9.2.1
xsom - update to 0-19.20110809svn
xsom-javadoc - update to 0-19.20110809svn
xml-stylebook-javadoc - update to 1.0-0.25.b3_xalan2.svn313293
xml-stylebook-demo - update to 1.0-0.25.b3_xalan2.svn313293
xml-stylebook - update to 1.0-0.25.b3_xalan2.svn313293
bea-stax - update to 1.2.0-16
bea-stax-api - update to 1.2.0-16
bea-stax-javadoc - update to 1.2.0-16
glassfish-fastinfoset - update to 1.2.13-9
glassfish-fastinfoset-javadoc - update to 1.2.13-9
xml-commons-resolver-javadoc - update to 1.2-26
xml-commons-resolver - update to 1.2-26
xml-commons-apis-manual - update to 1.4.01-25
xml-commons-apis-javadoc - update to 1.4.01-25
xml-commons-apis - update to 1.4.01-25
xmlstreambuffer-javadoc - update to 1.5.4-8
xmlstreambuffer - update to 1.5.4-8
stax-ex-javadoc - update to 1.7.7-8
stax-ex - update to 1.7.7-8
velocity-manual - update to 1.7-24
velocity-javadoc - update to 1.7-24
velocity-demo - update to 1.7-24
velocity - update to 1.7-24
slf4j-javadoc - update to 1.7.25-4
slf4j-ext - update to 1.7.25-4
slf4j-jdk14 - update to 1.7.25-4
slf4j-jcl - update to 1.7.25-4
slf4j-log4j12 - update to 1.7.25-4
slf4j - update to 1.7.25-4
jcl-over-slf4j - update to 1.7.25-4
jul-to-slf4j - update to 1.7.25-4
log4j-over-slf4j - update to 1.7.25-4
slf4j-sources - update to 1.7.25-4
slf4j-manual - update to 1.7.25-4
relaxngcc-javadoc - update to 1.12-14
relaxngcc - update to 1.12-14
glassfish-jax-rs-api-javadoc - update to 2.0.1-6
glassfish-jax-rs-api - update to 2.0.1-6
glassfish-jaxb-txw-parent - update to 2.2.11-12
glassfish-jaxb-runtime-parent - update to 2.2.11-12
glassfish-jaxb-runtime - update to 2.2.11-12
glassfish-jaxb-rngom - update to 2.2.11-12
glassfish-jaxb-parent - update to 2.2.11-12
glassfish-jaxb-core - update to 2.2.11-12
glassfish-jaxb-codemodel-parent - update to 2.2.11-12
glassfish-jaxb-codemodel-annotation-compiler - update to 2.2.11-12
glassfish-jaxb-codemodel - update to 2.2.11-12
glassfish-jaxb-bom-ext - update to 2.2.11-12
glassfish-jaxb-bom - update to 2.2.11-12
glassfish-jaxb-txw2 - update to 2.2.11-12
glassfish-jaxb-external-parent - update to 2.2.11-12
glassfish-jaxb - update to 2.2.11-12
glassfish-jaxb-api - update to 2.2.12-8
glassfish-jaxb-api-javadoc - update to 2.2.12-8
apache-commons-lang-javadoc - update to 2.6-21
apache-commons-lang - update to 2.6-21
xalan-j2-manual - update to 2.7.1-38
xalan-j2-xsltc - update to 2.7.1-38
xalan-j2 - update to 2.7.1-38
xalan-j2-javadoc - update to 2.7.1-38
xalan-j2-demo - update to 2.7.1-38
xerces-j2 - update to 2.11.0-34
xerces-j2-demo - update to 2.11.0-34
xerces-j2-javadoc - update to 2.11.0-34
jackson-dataformat-cbor - update to 2.18.8-150200.3.21.3
jackson-core - update to 2.18.8-150200.3.22.3
jackson-annotations - update to 2.18.8-150200.3.22.3
jackson-databind - update to 2.18.8-150200.3.28.2
jackson-annotations - update to 2.21-1
jackson-parent - update to 2.21-1
jackson-annotations (Red Hat package) - addressed in versions 2.21-1.el9_2, 2.21-1.el9_4, 2.21-1.el9_6, 2.21-1.el9_8
jackson-parent - update to 2.21-1.fc45
jackson-jaxrs-providers-parent - update to 2.21.4-1
jackson-jaxrs-providers-datatypes - update to 2.21.4-1
jackson-jaxrs-providers - update to 2.21.4-1
jackson-jaxrs-json-provider - update to 2.21.4-1
jackson-databind - update to 2.21.4-1
jackson-core - update to 2.21.4-1
jackson-bom - update to 2.21.4-1
jackson-core (Red Hat package) - addressed in versions 2.21.4-1.el9_2, 2.21.4-1.el9_4, 2.21.4-1.el9_6, 2.21.4-1.el9_8
jackson-modules-base (Red Hat package) - addressed in versions 2.21.4-1.el9_2, 2.21.4-1.el9_4, 2.21.4-1.el9_6, 2.21.4-1.el9_8
jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.21.4-1.el9_2, 2.21.4-1.el9_4, 2.21.4-1.el9_6, 2.21.4-1.el9_8
jackson-databind (Red Hat package) - addressed in versions 2.21.4-1.el9_2, 2.21.4-1.el9_4, 2.21.4-1.el9_6, 2.21.4-1.el9_8
jackson-module-jaxb-annotations - update to 2.21.4-2
jackson-modules-base - update to 2.21.4-2
jackson-modules-base - update to 2.21.5-1.fc45
jackson-jaxrs-providers - update to 2.21.5-1.fc45
jackson-databind - update to 2.21.5-1.fc45
jackson-core - update to 2.21.5-1.fc45
jackson-bom - update to 2.21.5-1.fc45
jackson-annotations - update to 2.21-6.fc45
resteasy - update to 3.0.26-7
resteasy-javadoc - update to 3.0.26-7
jakarta-commons-httpclient - update to 3.1-28
jakarta-commons-httpclient-demo - update to 3.1-28
jakarta-commons-httpclient-javadoc - update to 3.1-28
jakarta-commons-httpclient-manual - update to 3.1-28
apache-commons-collections-javadoc - update to 3.2.2-10
apache-commons-collections - update to 3.2.2-10
apache-commons-collections-testframework - update to 3.2.2-10
apache-commons-net - update to 3.6-3
apache-commons-net-javadoc - update to 3.6-3
javassist-javadoc - update to 3.18.1-8
javassist - update to 3.18.1-8
Red Hat build of Quarkus - addressed in versions 3.27.4.SP2, 3.33.2.SP2
Red Hat Camel for Spring Boot - update to 4.18
IBM SPSS Collaboration and Deployment Services - addressed in versions 8.4.0.0 IF005, 8.5.0.0 IF005, 8.6.0.0 IF005
JBoss Data Grid - update to 8.6.2
pki-servlet-engine - update to 9.0.62-1
dogtag-pki (Red Hat package) - addressed in versions 11.6.0-2.el10_0, 11.9.0-4.el10_2
EntireX - update to 12.1.0.0003-0779
fasterxml-oss-parent - update to 69-1
fasterxml-oss-parent - update to 75-1.fc45
relaxngDatatype-javadoc - update to 2011.1-7
relaxngDatatype - update to 2011.1-7
msv-xsdlib - update to 2013.6.1-10
msv-xmlgen - update to 2013.6.1-10
msv-rngconv - update to 2013.6.1-10
msv-msv - update to 2013.6.1-10
msv-demo - update to 2013.6.1-10
msv-javadoc - update to 2013.6.1-10
msv-manual - update to 2013.6.1-10

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f
• https://github.com/FasterXML/jackson-databind/pull/5983

• Multiple vulnerabilities in jackson-databind
• Fedora 45 update for fasterxml-oss-parent, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-jaxrs-providers, jackson-modules-base, jackson-parent
• Red Hat Enterprise Linux 9 update for multiple packages
• Red Hat Enterprise Linux 8 update for the pki-deps:10.6 module
• Red Hat Enterprise Linux 10 update for dogtag-pki
• SUSE update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent
• Red Hat Enterprise Linux 8 update for the pki-deps:10.6 module
• Red Hat Enterprise Linux 8 update for the pki-deps:10.6 module
• Red Hat Enterprise Linux 9 update for multiple packages
• Red Hat Enterprise Linux 9 update for multiple packages
• Red Hat Enterprise Linux 9 update for multiple packages
• Red Hat Enterprise Linux 8 update for the pki-deps:10.6 module
• Red Hat Enterprise Linux 10 update for dogtag-pki
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Anolis OS update for pki-deps:10.6 module
• Multiple vulnerabilities in IBM WebSphere Automation
• Multiple vulnerabilities in IBM EntireX
• Multiple vulnerabilities in IBM Db2 Bridge
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Netezza Appliance
• Multiple vulnerabilities in Red Hat build of Quarkus 3.27.4
• Multiple vulnerabilities in Red Hat build of Quarkus 3.33.2
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in Crucible Data Center and Crucible Server
• Multiple vulnerabilities in Crowd Data Center
• Multiple vulnerabilities in IBM Common Licensing