DEBIAN-CVE-2026-54513
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-54513
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-54513.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-54513
- Upstream
- Published
- 2026-06-23T21:17:02Z
- Modified
- 2026-09-15T08:47:41Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
- References
Affected packages
Debian:12 / jackson-databind
Package
- Name
- jackson-databind
- Purl
- pkg:deb/debian/jackson-databind?arch=source&distro=bookworm
Debian:13 / jackson-databind
Package
- Name
- jackson-databind
- Purl
- pkg:deb/debian/jackson-databind?arch=source&distro=trixie
Debian:14 / jackson-databind
Package
- Name
- jackson-databind
- Purl
- pkg:deb/debian/jackson-databind?arch=source&distro=forky