Bug 2492010 (CVE-2026-54513) - CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
Summary: CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arb...
Keywords:
Status: NEW
Alias: CVE-2026-54513
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2492652 2492651
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-23 22:01 UTC by OSIDB Bzimport
Modified: 2026-10-06 07:26 UTC (History)
143 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:36839 0 None None None 2026-07-08 18:28:42 UTC
Red Hat Product Errata RHSA-2026:40895 0 None None None 2026-07-16 11:56:47 UTC
Red Hat Product Errata RHSA-2026:41951 0 None None None 2026-07-20 11:57:16 UTC
Red Hat Product Errata RHSA-2026:43218 0 None None None 2026-07-22 05:37:39 UTC
Red Hat Product Errata RHSA-2026:43400 0 None None None 2026-07-22 10:18:24 UTC
Red Hat Product Errata RHSA-2026:44061 0 None None None 2026-07-23 01:03:58 UTC
Red Hat Product Errata RHSA-2026:44062 0 None None None 2026-07-23 00:43:07 UTC
Red Hat Product Errata RHSA-2026:44063 0 None None None 2026-07-23 00:45:02 UTC
Red Hat Product Errata RHSA-2026:44064 0 None None None 2026-07-23 01:28:29 UTC
Red Hat Product Errata RHSA-2026:44065 0 None None None 2026-07-23 01:09:38 UTC
Red Hat Product Errata RHSA-2026:44066 0 None None None 2026-07-23 01:21:58 UTC
Red Hat Product Errata RHSA-2026:44271 0 None None None 2026-07-23 06:31:30 UTC
Red Hat Product Errata RHSA-2026:48151 0 None None None 2026-07-29 19:53:47 UTC
Red Hat Product Errata RHSA-2026:54622 0 None None None 2026-08-13 14:51:07 UTC
Red Hat Product Errata RHSA-2026:66488 0 None None None 2026-09-10 16:36:46 UTC
Red Hat Product Errata RHSA-2026:66545 0 None None None 2026-09-10 23:24:47 UTC
Red Hat Product Errata RHSA-2026:69459 0 None None None 2026-09-21 14:39:57 UTC
Red Hat Product Errata RHSA-2026:70228 0 None None None 2026-09-22 12:56:47 UTC
Red Hat Product Errata RHSA-2026:70229 0 None None None 2026-09-22 13:01:21 UTC
Red Hat Product Errata RHSA-2026:70230 0 None None None 2026-09-22 12:59:15 UTC
Red Hat Product Errata RHSA-2026:70277 0 None None None 2026-09-22 15:36:23 UTC
Red Hat Product Errata RHSA-2026:76637 0 None None None 2026-10-06 07:26:36 UTC

Description OSIDB Bzimport 2026-06-23 22:01:57 UTC 
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Comment 4 errata-xmlrpc 2026-07-08 18:28:35 UTC 
This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Via RHSA-2026:36839 https://access.redhat.com/errata/RHSA-2026:36839
Comment 5 errata-xmlrpc 2026-07-16 11:56:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:40895 https://access.redhat.com/errata/RHSA-2026:40895
Comment 6 errata-xmlrpc 2026-07-20 11:57:08 UTC 
This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.2

Via RHSA-2026:41951 https://access.redhat.com/errata/RHSA-2026:41951
Comment 7 errata-xmlrpc 2026-07-22 05:37:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:43218 https://access.redhat.com/errata/RHSA-2026:43218
Comment 8 errata-xmlrpc 2026-07-22 10:18:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:43400 https://access.redhat.com/errata/RHSA-2026:43400
Comment 9 errata-xmlrpc 2026-07-23 00:42:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:44062 https://access.redhat.com/errata/RHSA-2026:44062
Comment 10 errata-xmlrpc 2026-07-23 00:44:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:44063 https://access.redhat.com/errata/RHSA-2026:44063
Comment 11 errata-xmlrpc 2026-07-23 01:03:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:44061 https://access.redhat.com/errata/RHSA-2026:44061
Comment 12 errata-xmlrpc 2026-07-23 01:09:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:44065 https://access.redhat.com/errata/RHSA-2026:44065
Comment 13 errata-xmlrpc 2026-07-23 01:21:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:44066 https://access.redhat.com/errata/RHSA-2026:44066
Comment 14 errata-xmlrpc 2026-07-23 01:28:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:44064 https://access.redhat.com/errata/RHSA-2026:44064
Comment 15 errata-xmlrpc 2026-07-23 06:31:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:44271 https://access.redhat.com/errata/RHSA-2026:44271
Comment 16 errata-xmlrpc 2026-07-29 19:53:40 UTC 
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:48151 https://access.redhat.com/errata/RHSA-2026:48151
Comment 19 errata-xmlrpc 2026-08-13 14:51:00 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16

Via RHSA-2026:54622 https://access.redhat.com/errata/RHSA-2026:54622
Comment 20 errata-xmlrpc 2026-09-10 16:36:38 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.14.1

Via RHSA-2026:66488 https://access.redhat.com/errata/RHSA-2026:66488
Comment 21 errata-xmlrpc 2026-09-10 23:24:41 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.13.6

Via RHSA-2026:66545 https://access.redhat.com/errata/RHSA-2026:66545
Comment 22 Jon Orris 2026-09-21 14:39:50 UTC 
This issue has been addressed in the following products:

  AMQ Clients 2026.Q3

Via RHSA-2026:69459 https://access.redhat.com/errata/RHSA-2026:69459
Comment 23 Jon Orris 2026-09-22 12:56:41 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

Via RHSA-2026:70228 https://access.redhat.com/errata/RHSA-2026:70228
Comment 24 Jon Orris 2026-09-22 12:59:08 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10

Via RHSA-2026:70230 https://access.redhat.com/errata/RHSA-2026:70230
Comment 25 Jon Orris 2026-09-22 13:01:15 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

Via RHSA-2026:70229 https://access.redhat.com/errata/RHSA-2026:70229
Comment 26 Jon Orris 2026-09-22 15:36:15 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1

Via RHSA-2026:70277 https://access.redhat.com/errata/RHSA-2026:70277
Comment 27 Jon Orris 2026-10-06 07:26:28 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apicurio Registry 3.3.3

Via RHSA-2026:76637 https://access.redhat.com/errata/RHSA-2026:76637
Note You need to log in before you can comment on or make changes to this bug.