CVE detail
CVE-2026-54513
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 30.0 · diversity 13.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
21 source links · newest first
- https://access.redhat.com/errata/RHSA-2026:44271access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:44066access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:44065access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:44064access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:44063access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:44062access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:44061access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:43400access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:43218access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:41951access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:40895access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comJun 23, 2026, 9:17 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2492010bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/security/cve/CVE-2026-54513access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM - https://access.redhat.com/errata/RHSA-2026:36839access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 23, 2026, 9:17 PM No excerpt available.
Exploitgithub.comJun 23, 2026, 9:17 PMNo excerpt available.
Exploitgithub.comJun 23, 2026, 9:17 PMNo excerpt available.
Exploitgithub.comJun 23, 2026, 9:17 PMNo excerpt available.
Exploitgithub.comJun 23, 2026, 9:17 PM- https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8egithub.com
No excerpt available.
Exploitgithub.comJun 23, 2026, 9:17 PM - https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5github.com
No excerpt available.
Exploitgithub.comJun 23, 2026, 9:17 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-54512CVSS 8.1 · High
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's…
- CVE-2018-7489CVSS 9.8 · Critical
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-…
- CVE-2017-7525CVSS 9.8 · Critical
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by s…
- CVE-2017-15095CVSS 9.8 · Critical
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending t…
- CVE-2018-5968CVSS 8.1 · High
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-1748…
- CVE-2026-50251CVSS 5.3 · Medium
In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-ci…