CVE-2026-54513 in Jackson Databind 2.17.*
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- Severity
- High 8.1
- Exploitation
-
1% chance of exploit
in the next 30 days - Fix
- Update to 2.18.8, 2.21.4, 3.1.4
- Where
- Test dependency
- How it matched
- Approximate – version line, checked against its .0 release
- Also known as
- GHSA-rmj7-2vxq-3g9f
- First seen
- 2026-11-05 01:13:58 UTC
- Source
- https://osv.dev/vulnerability/GHSA-rmj7-2vxq-3g9f