{"action":"Upgrade tools.jackson.core:jackson-databind to 3.1.4 or later.","affected":[{"fixed":"3.1.4","introduced":"3.0.0"}],"component":"tools.jackson.core:jackson-databind","cve_ids":["CVE-2026-54513"],"ecosystem":"Maven","epss":0.01226,"exploited":false,"fixed_versions":["3.1.4"],"ghsa_id":"GHSA-rmj7-2vxq-3g9f","id":"tcs_01M5N9C2N448PPNH70JDKT9P7N","modified_at":"2026-09-11T15:45:08.499771763Z","published_at":"2026-06-23T21:22:15Z","references":["https://osv.dev/vulnerability/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://github.com/FasterXML/jackson-databind","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-rmj7-2vxq-3g9f#Maven/tools.jackson.core:jackson-databind","url":"https://osv.dev/vulnerability/GHSA-rmj7-2vxq-3g9f"}],"summary":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"}