Polymorphic Deserialization Bypass in Jackson Databind

Compliance Impact

CVE-2026-54512 allows attackers to bypass type restrictions in jackson-databind's polymorphic deserialization, potentially leading to arbitrary code execution or unauthorized data manipulation if untrusted JSON input is processed. This security flaw could result in unauthorized access or modification of sensitive data.

Such unauthorized access or data manipulation risks could impact compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring data integrity.

Therefore, applications using vulnerable versions of jackson-databind that accept untrusted JSON and rely on polymorphic deserialization may face increased risk of non-compliance with these standards due to potential data breaches or integrity violations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in jackson-databind, a library used for data binding and tree-model processing in Jackson Data Processor. It involves the PolymorphicTypeValidator (PTV), which is supposed to safely control polymorphic deserialization by validating type identifiers.

When polymorphic typing is enabled and the type identifier contains generic parameters (indicated by a '<' character), the validation only checks the raw container class name before the '<'. If the container type is allowed, the full generic type string is parsed without validating the nested generic type arguments.

An attacker can exploit this by specifying a denied class as a generic type parameter inside an allowed container class. For example, if java.util.ArrayList is allowed but com.evil.Gadget is not, the attacker can use java.util.ArrayList<com.evil.Gadget>. The container passes validation, but the nested malicious class is loaded, instantiated, and populated with attacker-controlled data, bypassing the allow-list.

This flaw allows execution of unauthorized code during deserialization and is fixed in versions 2.18.8, 2.21.4, and 3.1.4 of jackson-databind.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to bypass security controls during deserialization and instantiate arbitrary classes with attacker-controlled data.

The consequences include remote code execution, data corruption, or unauthorized access to sensitive information, as the attacker can inject malicious objects into the application.

Given the CVSS score of 8.1 with high impact on confidentiality, integrity, and availability, exploitation could lead to significant compromise of the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade jackson-databind to one of the fixed versions: 2.18.8, 2.21.4, or 3.1.4.

This vulnerability arises because the PolymorphicTypeValidator (PTV) does not validate nested generic type arguments, allowing an attacker to bypass allow-lists. Upgrading to a fixed version ensures that this validation flaw is corrected.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from the jackson-databind library versions prior to 2.18.8, 2.21.4, and 3.1.4 where the PolymorphicTypeValidator fails to validate nested generic type parameters during polymorphic deserialization.

To detect if your system is vulnerable, first identify if your application uses jackson-databind versions between 2.10.0 and 2.18.7, or between 2.19.0 and 2.21.3, or between 3.0.0 and 3.1.3.

You can check the jackson-databind version in your project dependencies using commands like:

• For Maven: mvn dependency:tree | grep jackson-databind
• For Gradle: ./gradlew dependencies | grep jackson-databind

To detect exploitation attempts on your network or system, monitor for suspicious JSON payloads that include polymorphic type identifiers with generic parameters, such as type IDs containing the '<' character (e.g., java.util.ArrayList<com.evil.Gadget>).

You can use network monitoring tools or log analysis to search for such payloads. For example, using grep on application logs or network captures:

• grep -r '\<.*\>' /path/to/logs
• tcpdump -A -s 0 'tcp port 80 or tcp port 443' | grep -i 'java.util.ArrayList<'

Additionally, review your application logs for deserialization errors or unexpected class instantiations that could indicate exploitation attempts.

Useful 0 Not Useful 0