| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.10.0, < 2.18.8≥ 2.19.0, < 2.21.4≥ 3.0.0, < 3.1.4 | 2.18.82.21.43.1.4 |
| tools.jackson.core:jackson-databind | ≥ 3.0.0, < 3.1.4 | 3.1.4 |
| jackson-databind | ≥ 2.10.0, < 2.18.8≥ 2.19.0, < 2.21.4≥ 3.0.0, < 3.1.4 | 2.18.82.21.43.1.4 |
BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist.
Applications using BasicPolymorphicTypeValidator with allowIfSubTypeIsArray() as a safeguard get no protection for concrete array component types; an attacker controlling JSON can instantiate non-allowlisted types via an array wrapper, re-opening the gadget-instantiation risk PTV is meant to prevent.
git tag --contains)>= 2.10.0, < 2.18.8 -> fixed in 2.18.8>= 2.19.0, < 2.21.4 -> fixed in 2.21.4>= 3.0.0, < 3.1.4 -> fixed in 3.1.4PolymorphicTypeValidator was added in 2.10.0 so vulnerability N/A for versions prior to that.
Maintainer: significant. Reporter: HIGH. CWE-184 (Incomplete List of Disallowed Inputs); related CWE-502.
FasterXML/jackson-databind#5981; fix PR #5983 (24529da), 2.18 backport PR #5984 (01d1692). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.
Omkhar Arasaratnam (@omkhar) - finder.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free