EUVD-2026-38593

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator allowIfSubTypeIsArray...