CVE-2026-54512

{"id": "CVE-2026-54512", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54512", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T14:54:06.511108Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FasterXML", "product": "jackson-databind", "versions": [{"status": "affected", "version": ">= 2.10.0, < 2.18.8"}, {"status": "affected", "version": ">= 2.19.0, < 2.21.4"}, {"status": "affected", "version": ">= 3.0.0, < 3.1.4"}]}]}], "published": "2026-06-23T21:17:02.203", "references": [{"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FasterXML/jackson-databind/issues/5988", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-184"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container \u2014 for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}, {"lang": "es", "value": "jackson-databind contiene la funcionalidad de enlace de datos de prop\u00f3sito general y el modelo de \u00e1rbol para Jackson Data Processor. Desde 2.10.0 hasta 2.18.8, 2.21.4 y 3.1.4, el PolymorphicTypeValidator (PTV) de jackson-databind es el mecanismo de seguridad principal que protege la deserializaci\u00f3n polim\u00f3rfica. Cuando la tipificaci\u00f3n polim\u00f3rfica est\u00e1 habilitada y un identificador de tipo contiene par\u00e1metros gen\u00e9ricos (es decir, la cadena de ID de tipo contiene <), DatabindContext._resolveAndValidateGeneric() valida solo el nombre de la clase de contenedor en bruto (la subcadena antes de <) contra el PTV configurado. Si el tipo de contenedor es aprobado, el m\u00e9todo analiza la cadena de tipo can\u00f3nico completa a trav\u00e9s de TypeFactory.constructFromCanonical() y devuelve el tipo completamente parametrizado sin validar nunca los argumentos de tipo anidados contra el PTV. Los argumentos de tipo anidados son entonces resueltos, instanciados y poblados como beans durante la deserializaci\u00f3n. Un atacante que controla el ID de tipo puede, por lo tanto, colocar una clase denegada como par\u00e1metro de tipo gen\u00e9rico de un contenedor permitido - por ejemplo, java.util.ArrayList<com.evil.Gadget> cuando solo java.util.ArrayList est\u00e1 en la lista de permitidos. El contenedor pasa la verificaci\u00f3n del PTV; com.evil.Gadget se carga a trav\u00e9s de Class.forName(name, true, loader), se instancia y sus propiedades se configuran desde JSON controlado por el atacante. Esto elude completamente una lista de permitidos del PTV configurada expl\u00edcitamente. Esta vulnerabilidad se corrige en 2.18.8, 2.21.4 y 3.1.4."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "925984A4-A2EF-4681-804A-F830B33D6876", "versionEndExcluding": "2.18.8", "versionStartIncluding": "2.10.0"}, {"criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59601D96-4AB4-4B53-8DEC-305A6D442E6E", "versionEndExcluding": "2.21.4", "versionStartIncluding": "2.19.0"}, {"criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C0F99DE-1DB7-4873-83F9-6CEF8E91F33C", "versionEndExcluding": "3.1.4", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}