CVE-2026-54512: 
Java vulnerability analysis and mitigation

CVE-2026-54512 is a PolymorphicTypeValidator (PTV) bypass vulnerability in FasterXML jackson-databind that allows arbitrary class instantiation during polymorphic deserialization. It affects jackson-databind versions 2.10.0–2.18.7, 2.19.0–2.21.3, and 3.0.0–3.1.3. The vulnerability was reported by security researchers caveeroo, omkhar, and 75ACOL, with the fix merged on May 12, 2026, and the advisory published on June 16–23, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Github Advisory, FasterXML Advisory).

The root cause is an incomplete input validation flaw (CWE-184) combined with unsafe deserialization (CWE-502) in DatabindContext._resolveAndValidateGeneric(). When a type identifier string contains generic parameters (i.e., includes <), the method validates only the raw container class name (the substring before <) against the configured PTV allow-list, then calls TypeFactory.constructFromCanonical() to construct the full parameterized type — without ever validating the nested type arguments. As a result, an attacker who controls the type ID can embed a denied gadget class as a generic parameter of an allow-listed container (e.g., java.util.ArrayList<com.evil.Gadget>): the container passes the PTV check, while the gadget class is loaded via Class.forName(name, true, loader), instantiated, and populated with attacker-controlled JSON properties. The fix (commit 434d6c5) adds recursive validation of all non-trivial type parameters through the full PTV chain (FasterXML Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to completely bypass an explicitly configured PTV allow-list, instantiate arbitrary classes with attacker-controlled property values via setter/field injection, and potentially achieve remote code execution. When exploitable gadget classes (e.g., JNDI lookup handlers, JDBC connection-pool gadgets, or TemplatesImpl-style class loaders) are present on the classpath, the attacker can achieve full confidentiality, integrity, and availability compromise of the affected application. Applications that accept untrusted JSON and rely on a configured BasicPolymorphicTypeValidator — the documented security-conscious configuration — are specifically at risk (Github Advisory).

A proof-of-concept exploit with a concrete malicious JSON payload and step-by-step configuration is publicly available in the official security advisory (FasterXML Advisory). The NVD SSVC assessment classifies exploitation status as "poc" with "total" technical impact. No evidence of in-the-wild exploitation has been reported as of the advisory date. The EPSS score is approximately 0.617% (45th percentile), and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires high attack complexity (the attacker must control the type ID in deserialized JSON), but no privileges or user interaction are needed (Github Advisory).

1. Identify a target: Locate a Java application using jackson-databind 2.10.0–2.18.7, 2.19.0–2.21.3, or 3.0.0–3.1.3 that accepts untrusted JSON input and has polymorphic typing enabled with a BasicPolymorphicTypeValidator configured.
2. Identify an allow-listed container: Determine which container classes (e.g., java.util.ArrayList, java.util.HashMap) are approved by the application's PTV allow-list, either through source code review, error message analysis, or fuzzing.
3. Identify a gadget class: Find a class on the target's classpath with exploitable side effects during instantiation or property setting (e.g., JNDI lookup, JDBC connection-pool gadget, TemplatesImpl-style loader).
4. Craft the malicious payload: Construct a JSON payload embedding the gadget class as a generic type parameter of the allow-listed container. Example using @JsonTypeInfo(use = Id.CLASS, include = As.WRAPPER_ARRAY):

{"value":["java.util.ArrayList<com.evil.EvilGadget>",[{"cmd":"calc.exe"}]]}

5. Submit the payload: Send the crafted JSON to the vulnerable endpoint. The container class passes the PTV check; the gadget class is loaded via Class.forName(), instantiated, and its properties are set from the attacker-controlled JSON, triggering the gadget's side effects.
6. Achieve objective: Depending on the gadget, this may result in remote code execution, SSRF, data exfiltration, or other impacts (FasterXML Advisory).

• Network: Unexpected outbound connections from the Java application server to external hosts (indicative of JNDI/LDAP lookups or reverse shells triggered by gadget instantiation); unusual DNS queries for attacker-controlled domains.
• Logs: Application logs showing InvalidTypeIdException errors (on patched versions blocking the attack) or unexpected class loading of non-standard types; Jackson deserialization errors referencing unfamiliar fully-qualified class names with generic parameters (e.g., strings containing < in type IDs).
• Process: Unusual child processes spawned by the Java application process (e.g., cmd.exe, /bin/bash, curl, wget); unexpected JVM class loading of gadget classes such as those related to JNDI, JDBC connection pools, or TemplatesImpl.
• File System: New or modified files in the application directory created by the Java process; unexpected web shells or scripts dropped by the application service account.

Upgrade jackson-databind to one of the patched versions: 2.18.8 (for the 2.10.0–2.18.x branch), 2.21.4 (for the 2.19.0–2.21.x branch), or 3.1.4 (for the 3.0.0–3.1.x branch). The fix adds recursive PTV validation of all generic type parameters, closing the bypass. If immediate patching is not possible, disable polymorphic deserialization entirely or restrict JSON input to trusted, internal systems only. Note that the vulnerability only affects applications using PolymorphicTypeValidator (introduced in 2.10.0); versions prior to 2.10.0 are not affected (FasterXML Advisory, Fix Commit).

HeroDevs published a vulnerability directory entry and a dedicated blog post covering CVE-2026-54512 alongside a related issue (CVE-2026-54513), providing additional context on the PTV bypass class (HeroDevs Blog). The Western Australian Government SOC issued an advisory on June 29, 2026, recommending immediate patching (WA SOC Advisory). Red Hat issued a security errata (RHSA-2026:36002) addressing the vulnerability in their affected products. OpenSUSE and SUSE also released security updates for their distributions. The Apache Spark project upgraded to Jackson 2.21.4 specifically to address this CVE (Fix PR #5988).