jackson-databind's BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() method allows any array type based solely on clazz.isArray(), without validating the array's component type against the allowlist. Consequently, even when an explicit concrete-type allowlist is configured, unallowlisted component types can be deserialized if they appear as array elements without per-element type IDs. This bypasses intended type validation controls and enables arbitrary code execution. The vulnerability affects versions >=2.10.0 and <2.18.8, <2.21.4, and <3.1.4. It is fixed in versions 2.18.8, 2.21.4, and 3.1.4. The flaw impacts confidentiality, integrity, and availability by permitting execution of malicious code through crafted input deserialized by jackson-databind.

An attacker can bypass security controls designed to validate data types during deserialization, leading to arbitrary code execution. This results in a complete compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects applications using jackson-databind with the vulnerable configuration and versions, potentially allowing remote code execution without authentication or user interaction.

Upgrade jackson-databind to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading immediately is not possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the ObjectMapper configuration, then rebuild and restart the application. Additionally, disable polymorphic deserialization of untrusted data where possible by avoiding default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted packages and avoid broad or permissive type validation rules.