CVE-2026-54512: FasterXML jackson-databind PolymorphicTypeValidator bypass via generic types

CVE-2026-54512 · Severity: high · CVSS 8.1 · Published 2026-06-23

A vulnerability in the Jackson data-processing library allows attackers to bypass security filters designed to prevent the loading of malicious code. By disguising unauthorized Java classes inside allowed data containers (like lists or maps), an attacker can force the application to execute unintended actions. This can lead to full system compromise, unauthorized data access, or service disruption if the application processes untrusted JSON data.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-54512 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54512 being exploited in the wild.
How severe is CVE-2026-54512?
High severity, with a CVSS score of 8.1, published 23 June 2026.
Which products and versions are affected?
FasterXML Jackson Databind >= 2.10.0, < 2.18.8, >= 2.10.0, <= 2.18.7; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.10.0,fixed=2.18.8; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.4.
Is there a fix for CVE-2026-54512?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.8 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54512 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54512?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.8 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.18.8 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later
    # set tools.jackson.core:jackson-databind to 3.1.4 in your pom.xml or build.gradle

Technical details

A deserialization vulnerability exists in jackson-databind's PolymorphicTypeValidator (PTV) due to incomplete validation of generic type parameters. When polymorphic typing is enabled, the 'DatabindContext._resolveAndValidateGeneric()' method validates only the raw container class (e.g., java.util.ArrayList) against the PTV allow-list, failing to inspect nested type arguments. An attacker can provide a type identifier containing a malicious 'gadget' class as a generic parameter (e.g., ArrayList<EvilGadget>), which the validator ignores. This results in the instantiation and property population of the unauthorized class, potentially leading to remote code execution (RCE) if exploitable classes are present on the classpath. The issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4 by implementing recursive validation of type parameters.

Affected products

  • FasterXML jackson-databind >= 2.10.0, < 2.18.8
  • FasterXML jackson-databind >= 2.19.0, < 2.21.4
  • FasterXML, tools.jackson.core jackson-databind >= 3.0.0, < 3.1.4

Identifiers

  • CVE-2026-54512
  • GHSA-j3rv-43j4-c7qm

Timeline

  • 2026-05-11: other: Fix implemented in source code
  • 2026-06-16: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.