Bug 2492010 (CVE-2026-54513) - CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
Summary: CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arb...
Keywords:
Status: NEW
Alias: CVE-2026-54513
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2492652 2492651
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-23 22:01 UTC by OSIDB Bzimport
Modified: 2026-08-04 17:36 UTC (History)
140 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:36839 0 None None None 2026-07-08 18:28:42 UTC
Red Hat Product Errata RHSA-2026:40895 0 None None None 2026-07-16 11:56:47 UTC
Red Hat Product Errata RHSA-2026:41951 0 None None None 2026-07-20 11:57:16 UTC
Red Hat Product Errata RHSA-2026:43218 0 None None None 2026-07-22 05:37:39 UTC
Red Hat Product Errata RHSA-2026:43400 0 None None None 2026-07-22 10:18:24 UTC
Red Hat Product Errata RHSA-2026:44061 0 None None None 2026-07-23 01:03:58 UTC
Red Hat Product Errata RHSA-2026:44062 0 None None None 2026-07-23 00:43:07 UTC
Red Hat Product Errata RHSA-2026:44063 0 None None None 2026-07-23 00:45:02 UTC
Red Hat Product Errata RHSA-2026:44064 0 None None None 2026-07-23 01:28:29 UTC
Red Hat Product Errata RHSA-2026:44065 0 None None None 2026-07-23 01:09:38 UTC
Red Hat Product Errata RHSA-2026:44066 0 None None None 2026-07-23 01:21:58 UTC
Red Hat Product Errata RHSA-2026:44271 0 None None None 2026-07-23 06:31:30 UTC
Red Hat Product Errata RHSA-2026:48151 0 None None None 2026-07-29 19:53:47 UTC

Description OSIDB Bzimport 2026-06-23 22:01:57 UTC 
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Comment 4 errata-xmlrpc 2026-07-08 18:28:35 UTC 
This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Via RHSA-2026:36839 https://access.redhat.com/errata/RHSA-2026:36839
Comment 5 errata-xmlrpc 2026-07-16 11:56:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:40895 https://access.redhat.com/errata/RHSA-2026:40895
Comment 6 errata-xmlrpc 2026-07-20 11:57:08 UTC 
This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.2

Via RHSA-2026:41951 https://access.redhat.com/errata/RHSA-2026:41951
Comment 7 errata-xmlrpc 2026-07-22 05:37:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:43218 https://access.redhat.com/errata/RHSA-2026:43218
Comment 8 errata-xmlrpc 2026-07-22 10:18:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:43400 https://access.redhat.com/errata/RHSA-2026:43400
Comment 9 errata-xmlrpc 2026-07-23 00:42:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:44062 https://access.redhat.com/errata/RHSA-2026:44062
Comment 10 errata-xmlrpc 2026-07-23 00:44:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:44063 https://access.redhat.com/errata/RHSA-2026:44063
Comment 11 errata-xmlrpc 2026-07-23 01:03:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:44061 https://access.redhat.com/errata/RHSA-2026:44061
Comment 12 errata-xmlrpc 2026-07-23 01:09:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:44065 https://access.redhat.com/errata/RHSA-2026:44065
Comment 13 errata-xmlrpc 2026-07-23 01:21:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:44066 https://access.redhat.com/errata/RHSA-2026:44066
Comment 14 errata-xmlrpc 2026-07-23 01:28:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:44064 https://access.redhat.com/errata/RHSA-2026:44064
Comment 15 errata-xmlrpc 2026-07-23 06:31:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:44271 https://access.redhat.com/errata/RHSA-2026:44271
Comment 16 errata-xmlrpc 2026-07-29 19:53:40 UTC 
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:48151 https://access.redhat.com/errata/RHSA-2026:48151
Note You need to log in before you can comment on or make changes to this bug.