CVE-2026-54513: 
Java vulnerability analysis and mitigation

CVE-2026-54513 is an array subtype allowlist bypass vulnerability in FasterXML jackson-databind's BasicPolymorphicTypeValidator (PTV) that allows unauthenticated attackers to instantiate arbitrary non-allowlisted classes during deserialization, potentially enabling remote code execution. The flaw affects jackson-databind versions 2.10.0 through 2.18.7, 2.19.0 through 2.21.3, and 3.0.0 through 3.1.3. It was discovered by Omkhar Arasaratnam and fixed on June 4, 2026, with the advisory published on June 23, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs). The BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() method approved any array type by checking only clazz.isArray(), without recursively validating the array's component (element) type against the configured allowlist. As a result, a PTV configured with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist would still permit deserialization of EvilType[] even though EvilType itself was not allowlisted — because the array matched the array check, and when Jackson deserialized the elements without per-element type IDs, it instantiated the component type directly with no further PTV validation. The fix (PR #5983, commit 24529da; backport PR #5984, commit 01d1692) changes allowIfSubTypeIsArray() to recursively unwrap array types and validate the innermost element type against the configured sub-class matchers, exempting only primitives, abstract classes, and interfaces (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to instantiate arbitrary Java classes (gadget chains) during JSON deserialization, re-opening the class-instantiation risk that PolymorphicTypeValidator was designed to prevent. This can lead to remote code execution with the privileges of the application process, as well as full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is particularly impactful in environments where jackson-databind is used with polymorphic type handling and allowIfSubTypeIsArray() is part of the PTV configuration, which is common in enterprise Java applications including numerous Red Hat products (GitHub Advisory, Red Hat).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.677%, reflecting a currently low but non-negligible probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity (AC:H) because the attacker must control the JSON input to a vulnerable deserialization endpoint and the application must be configured with allowIfSubTypeIsArray() in its PTV, limiting the attack surface compared to broader deserialization issues.

1. Reconnaissance: Identify Java applications that use jackson-databind versions 2.10.0–2.18.7, 2.19.0–2.21.3, or 3.0.0–3.1.3 with polymorphic type handling enabled and a BasicPolymorphicTypeValidator configured with allowIfSubTypeIsArray().
2. Identify deserialization endpoint: Locate an HTTP endpoint or message queue consumer that accepts JSON and deserializes it into a polymorphic type (e.g., a field typed as Object or an abstract class with @JsonTypeInfo).
3. Craft malicious JSON payload: Construct a JSON payload that specifies a non-allowlisted gadget class wrapped as an array type. For example, use the JVM internal array class name format [Lcom.example.EvilGadget; as the type identifier, with the array contents being the gadget's constructor arguments:

   {"value":["[Lcom.example.EvilGadget;", [{"cmd": "malicious_command"}]]}

4. Submit payload: Send the crafted JSON to the vulnerable endpoint. The PTV checks the array type ([Lcom.example.EvilGadget;) against clazz.isArray(), which returns true, so the array is approved without checking EvilGadget against the allowlist.
5. Trigger class instantiation: Jackson deserializes the array elements, instantiating EvilGadget directly via bean deserialization with no further PTV check, executing any gadget chain logic in the constructor or setter methods.
6. Achieve objective: Depending on the gadget class available on the classpath, achieve remote code execution, SSRF, file read/write, or other impacts (GitHub Advisory, Fix Commit).

• Network: Unexpected HTTP requests containing JSON payloads with JVM internal array class name formats (e.g., strings matching \[L<classname>; or \[\[L<classname>;) in request bodies to REST or messaging endpoints.
• Logs: Application logs showing InvalidTypeIdException or unexpected class resolution attempts for non-allowlisted types; Jackson deserialization errors referencing array component types not in the configured allowlist.
• Process: Unusual child processes spawned by the Java application server (e.g., bash, curl, wget, python) that are not part of normal application behavior, potentially indicating successful gadget chain execution.
• File System: Unexpected new files, scripts, or web shells written to the application directory or temp directories by the Java process user account.

Upgrade jackson-databind to one of the patched versions: 2.18.8, 2.21.4, or 3.1.4, which were released on June 4, 2026. If immediate patching is not possible, review all uses of BasicPolymorphicTypeValidator and remove or avoid allowIfSubTypeIsArray(), replacing it with explicit allowlisting of specific array component types. Additionally, restrict deserialization of untrusted JSON input and consider disabling polymorphic type handling where not strictly required. Red Hat has confirmed impact across numerous products (AMQ Broker, JBoss EAP, Keycloak, Quarkus, etc.) and is tracking remediation via their security advisory process (GitHub Advisory, Red Hat, Red Hat Bugzilla).

The vulnerability was reported by Omkhar Arasaratnam and fixed by jackson-databind maintainer cowtowncoder (Tatu Saloranta) with assistance from Claude AI tooling, as noted in the commit history. The fix was backported to the 2.18 branch and released in 2.18.8, 2.21.4, and 3.1.4. Red Hat issued a security advisory tracking impact across a broad range of their Java middleware and platform products. HeroDevs published a blog post covering this CVE alongside the related CVE-2026-54512, providing additional context for the jackson-databind polymorphic type validator bypass class of issues (GitHub Advisory, HeroDevs Blog, Red Hat).