{"id":"GHSA-j3rv-43j4-c7qm","aliases":["CVE-2026-54512"],"title":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"`jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains `<`), `DatabindContext._resolveAndValidateGeneric()` validates **only the raw container class name** (the substring before `<`) against the configured PTV.\n\nIf the container type is approved, the method parses the full canonical type string via `TypeFactory.constructFromCanonical()` and returns the fully parameterized type **without ever validating the nested type arguments** against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization.\n\nAn attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example `java.util.ArrayList<com.evil.Gadget>` when only `java.util.ArrayList` is allow-listed. The container passes the PTV check; `com.evil.Gadget` is loaded via `Class.forName(name, true, loader)`, instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list.\n\nThis is the same vulnerability class responsible for the historical sequence of jackson-databind deserialization CVEs; here it manifests as a validator bypass rather than a missing deny-list entry.\n\n\n## Impact\n\n- **Bypass of the PTV allow-list**, including the recommended `BasicPolymorphicTypeValidator` configured with name-prefix allow rules.\n- **Arbitrary class instantiation** of any type assignable to the container's element/parameter position, with attacker-controlled property values (setter/field injection).\n- **Potential unauthenticated remote code execution** when a class with exploitable side effects (JNDI lookup, JDBC/connection-pool gadgets,`TemplatesImpl`-style loaders, etc.) is present on the classpath.\n\nApplications that accept untrusted JSON and rely on a configured PTV — the documented, security-conscious configuration — are affected.\n\n\n## Proof of Concept\n\nConfiguration restricting polymorphic deserialization to a single safe container:\n\n```java\nBasicPolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()\n        .allowIfSubType(\"java.util.ArrayList\")\n        .build();\n\nObjectMapper mapper = JsonMapper.builder()\n        .polymorphicTypeValidator(ptv)\n        .build();\n```\n\nMalicious payload (`Wrapper.value` is `Object` with `@JsonTypeInfo(use = Id.CLASS, include = As.WRAPPER_ARRAY)`):\n\n```json\n{\"value\":[\"java.util.ArrayList<com.evil.EvilGadget>\",[{\"cmd\":\"calc.exe\"}]]}\n```\n\nOn vulnerable versions, `com.evil.EvilGadget` is instantiated and its `cmd` property is set, despite only `java.util.ArrayList` being allow-listed. On `2.18.8` / `2.21.4` / `3.1.4` the deserialization throws `InvalidTypeIdException` before instantiation.\n\n**Variant payloads** (all bypass an `ArrayList`/`HashMap` allow-list):\n\n| Type ID | Smuggled type position |\n|---|---|\n| `java.util.ArrayList<Evil>` | list element |\n| `java.util.HashMap<Evil,String>` | map key |\n| `java.util.HashMap<String,Evil>` | map value |\n| `java.util.ArrayList<java.util.ArrayList<Evil>>` | nested element |\n| `java.util.ArrayList<Evil[]>` | array element |\n\n---\n\n## Patches\n\nFixed in **2.18.8**, **2.21.4** and **3.1.4** via the changes for [FasterXML/jackson-databind#5988](https://github.com/FasterXML/jackson-databind/issues/5988), commit `434d6c511`. The fix adds recursive validation of each non-trivial type parameter (and array element types appearing as parameters) through the full PTV chain, with documented exemptions for `Object` (wildcard resolution) and `Enum` types.\n\n`PolymorphicTypeValidator` was added in 2.10.0 so vulnerability N/A for versions prior to that.","severity":"high","score":8.1,"published":"2026-06-23T21:21:38.000Z","modified":"2026-10-28T10:56:49.472Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","sources":[{"name":"OSV · GHSA-j3rv-43j4-c7qm","url":"https://osv.dev/vulnerability/GHSA-j3rv-43j4-c7qm"}],"ranges":[{"events":[{"introduced":"2.10.0"},{"fixed":"2.18.8"}],"type":"ECOSYSTEM"}],"versions":["2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.18.1","2.18.2","2.18.3","2.18.4","2.18.5","2.18.6","2.18.7"],"fixed":["2.18.8"]},{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","sources":[{"name":"OSV · GHSA-j3rv-43j4-c7qm","url":"https://osv.dev/vulnerability/GHSA-j3rv-43j4-c7qm"}],"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["3.1.4"]},{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","sources":[{"name":"OSV · GHSA-j3rv-43j4-c7qm","url":"https://osv.dev/vulnerability/GHSA-j3rv-43j4-c7qm"}],"ranges":[{"events":[{"introduced":"2.19.0"},{"fixed":"2.21.4"}],"type":"ECOSYSTEM"}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3"],"fixed":["2.21.4"]},{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","sources":[{"name":"OSV · GHSA-j3rv-43j4-c7qm","url":"https://osv.dev/vulnerability/GHSA-j3rv-43j4-c7qm"}],"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3"],"fixed":["3.1.4"]}],"sourceAffected":[],"references":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://nvd.nist.gov/vuln/detail/CVE-2026-54512","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind"],"sources":[{"name":"OSV","id":"GHSA-j3rv-43j4-c7qm","modified":"2026-10-28T10:56:49.472327085Z","url":"https://osv.dev/vulnerability/GHSA-j3rv-43j4-c7qm"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T01:50:33.295Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T12:05:34.135Z","attemptedAt":"2026-10-28T12:05:34.135Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T12:05:34.521Z","attemptedAt":"2026-10-28T12:05:34.521Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T12:05:35.048Z","attemptedAt":"2026-10-28T12:05:35.048Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-28T12:05:33.923Z","attemptedAt":"2026-10-28T12:05:33.923Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-54512","url":"https://www.first.org/epss/","probability":0.00944,"percentile":0.60878,"date":"2026-10-27","checkedAt":"2026-10-28T12:05:33.923Z"},{"source":"NVD","id":"CVE-2026-54512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","modified":"2026-10-25T23:10:00.167","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T12:05:34.135Z"},{"source":"GitHub Advisory Database","id":"GHSA-j3rv-43j4-c7qm","url":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","modified":"2026-07-20T21:21:15Z","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T12:05:34.521Z"},{"source":"ENISA EUVD","id":"EUVD-2026-38595","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38595","modified":"Jun 24, 2026, 3:22:43 PM","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T12:05:35.048Z"}]}