The vulnerability in jackson-databind arises from insufficient validation of array component types in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray(). This method allowlists any array type based on clazz.isArray() without checking the component element type against the allowlist. Consequently, even when a strict allowlist is configured, arrays of unallowlisted types (e.g., EvilType[]) can be deserialized. During deserialization, if no per-element type IDs are present, the component type is instantiated directly, bypassing further validation. This flaw enables attackers to bypass security controls and potentially execute arbitrary code. The issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4 of jackson-databind. The Red Hat advisory confirms the impact and provides mitigation guidance, including upgrading or removing the vulnerable configuration. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, high complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to bypass type validation during deserialization, leading to arbitrary code execution. This compromises the confidentiality, integrity, and availability of affected systems using jackson-databind with the vulnerable configuration. The vulnerability affects applications that use polymorphic deserialization with BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray(), potentially resulting in complete system compromise.

A fix is available in jackson-databind versions 2.18.8, 2.21.4, and 3.1.4 or later. Users should upgrade to these versions to address the vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the ObjectMapper configuration and restart the application. Additionally, disable polymorphic deserialization of untrusted data where possible by avoiding default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is necessary, restrict allowed subtypes using a strict whitelist of trusted packages and avoid broad or permissive validation rules.