Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2026-54513

Incomplete List of Disallowed Inputs

Published: Jun 23, 2026 | Modified: Jul 30, 2026
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
8.1 IMPORTANT
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-54513
CWEhttps://cwe.mitre.org/data/definitions/184.html

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the arrays component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Weakness

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Affected Software

NameVendorStart VersionEnd Version
Jackson-databindFasterxml2.10.0 (including)2.18.8 (excluding)
Jackson-databindFasterxml2.19.0 (including)2.21.4 (excluding)
Jackson-databindFasterxml3.0.0 (including)3.1.4 (excluding)
Cryostat 4 on RHEL 9RedHatcryostat/cryostat-reports-rhel9:4.2.0-13*
Cryostat 4 on RHEL 9RedHatcryostat/cryostat-rhel9:4.2.0-13*
Cryostat 4 on RHEL 9RedHatcryostat/jfr-datasource-rhel9:4.2.0-13*
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33RedHatjackson-databind*
Red Hat Certificate System 10.8 for RHEL-8RedHatredhat-pki:10-8100020260728001635.f9354743*
Red Hat Data Grid 8.6.2RedHatjackson-databind*
Red Hat Enterprise Linux 10RedHatdogtag-pki-0:11.9.0-4.el10_2*
Red Hat Enterprise Linux 10.0 Extended Update SupportRedHatdogtag-pki-0:11.6.0-2.el10_0*
Red Hat Enterprise Linux 8RedHatpki-deps:10.6-8100020260714102233.489197e6*
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRedHatpki-deps:10.6-8040020260720064222.522a0ee4*
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRedHatpki-deps:10.6-8040020260720064222.522a0ee4*
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRedHatpki-deps:10.6-8060020260720025549.ad008a3a*
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRedHatpki-deps:10.6-8060020260720025549.ad008a3a*
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRedHatpki-deps:10.6-8080020260714161755.63b34585*
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRedHatpki-deps:10.6-8080020260714161755.63b34585*
Red Hat Enterprise Linux 9RedHatjackson-databind-0:2.21.4-1.el9_8*
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRedHatjackson-databind-0:2.21.4-1.el9_2*
Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRedHatjackson-databind-0:2.21.4-1.el9_4*
Red Hat Enterprise Linux 9.6 Extended Update SupportRedHatjackson-databind-0:2.21.4-1.el9_6*
Jackson-databindUbuntuquesting*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use