# CVE-2026-54512: FasterXML jackson-databind PolymorphicTypeValidator bypass via generic types

Source: https://junglewise.ai/threats/cve-2026-54512-fasterxml-jackson-databind-polymorphictypevalidator-bypass-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-54512 · Severity: high · CVSS 8.1 · Published 2026-06-23

A vulnerability in the Jackson data-processing library allows attackers to bypass security filters designed to prevent the loading of malicious code. By disguising unauthorized Java classes inside allowed data containers (like lists or maps), an attacker can force the application to execute unintended actions. This can lead to full system compromise, unauthorized data access, or service disruption if the application processes untrusted JSON data.

Technologies: [FasterXML Jackson Databind](https://junglewise.ai/threats/technologies/jackson-databind), [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind), [tools.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/tools-jackson-core-jackson-databind). Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-54512 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54512 being exploited in the wild.

**How severe is CVE-2026-54512?** High severity, with a CVSS score of 8.1, published 23 June 2026.

**Which products and versions are affected?** FasterXML Jackson Databind >= 2.10.0, < 2.18.8, >= 2.10.0, <= 2.18.7; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.10.0,fixed=2.18.8; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.4.

**Is there a fix for CVE-2026-54512?** Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.8 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54512 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54512?** Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.8 or later

  ```sh
  # set com.fasterxml.jackson.core:jackson-databind to 2.18.8 in your pom.xml or build.gradle
  ```

- tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later

  ```sh
  # set tools.jackson.core:jackson-databind to 3.1.4 in your pom.xml or build.gradle
  ```


## Technical details

A deserialization vulnerability exists in jackson-databind's PolymorphicTypeValidator (PTV) due to incomplete validation of generic type parameters. When polymorphic typing is enabled, the 'DatabindContext._resolveAndValidateGeneric()' method validates only the raw container class (e.g., java.util.ArrayList) against the PTV allow-list, failing to inspect nested type arguments. An attacker can provide a type identifier containing a malicious 'gadget' class as a generic parameter (e.g., ArrayList<EvilGadget>), which the validator ignores. This results in the instantiation and property population of the unauthorized class, potentially leading to remote code execution (RCE) if exploitable classes are present on the classpath. The issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4 by implementing recursive validation of type parameters.

## Affected products

- FasterXML jackson-databind >= 2.10.0, < 2.18.8
- FasterXML jackson-databind >= 2.19.0, < 2.21.4
- FasterXML, tools.jackson.core jackson-databind >= 3.0.0, < 3.1.4

## Identifiers

- CVE-2026-54512
- GHSA-j3rv-43j4-c7qm

## Timeline

- 2026-05-11: other: Fix implemented in source code
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD

## References

- [https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5](https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5)
- [https://github.com/FasterXML/jackson-databind/issues/5988](https://github.com/FasterXML/jackson-databind/issues/5988)
- [https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm)

## Related threats

- [jackson-databind type validation bypass in generic arguments](https://junglewise.ai/threats/cve-2026-110879-jackson-databind-validates-the-outer-class-of-a-class-name-type)
- [Jackson Protobuf Parser integer overflow in string key parsing](https://junglewise.ai/threats/cve-2026-110747-protobufparser-readstringkey-reads-the-length-prefix-of-a)
- [jackson-databind quadratic complexity in forward-reference resolution](https://junglewise.ai/threats/cve-2026-91777-jackson-databind-quadratic-forward-reference-completion)
- [FasterXML Jackson Databind unbounded cache growth on unknown type IDs](https://junglewise.ai/threats/cve-2026-91776-jackson-databind-retains-every-unknown-raw-type-id)
- [FasterXML jackson-databind quadratic parse in XML datatype deserialization](https://junglewise.ai/threats/cve-2026-68497-fasterxml-jackson-databind-quadratic-parse-in-xml-datatype)