CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

🗓️ 23 Jun 2026 20:56:36Reported by GitHub_MType

CVE-2026-54512: Jackson datbind PTV bypass allows class instantiation via generic parameters; fixed in 2.18.8, 2.21.4, 3.1.4.

Reporter	Title	Published	Views	Family All 280
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been detected in IBM Security Verify Governance Identity Manager Adapters	13 Jul 202606:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.	25 Jul 202616:37	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in jackson-databind may affect IBM APM Linux KVM Agent for Virtual Environments.	4 Aug 202608:12	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in jackson-databind	30 Jul 202618:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	7 Jul 202616:27	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been detected in IBM Security Verify Governance Identity Manager Adapters	13 Jul 202606:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j API and jackson-databind	29 Jul 202614:19	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs	3 Aug 202608:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	8 Jul 202616:15	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jackson-databind, IBM EntireX is vulnerable to multiple vulnerabilities.	3 Aug 202614:45	–	ibm

[
  {
    "vendor": "FasterXML",
    "product": "jackson-databind",
    "versions": [
      {
        "version": ">= 2.10.0, < 2.18.8",
        "status": "affected"
      },
      {
        "version": ">= 2.19.0, < 2.21.4",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.1.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm
github	www.github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5
github	www.github.com/FasterXML/jackson-databind/issues/5988

23 Jun 2026 20:56Current

CVSS 3.18.1

EPSS0.00779