The vulnerability in jackson-databind arises from the BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() method, which permits any array type based solely on the array nature of the class, without validating the array's element type against the configured allowlist. Consequently, even with an explicit allowlist of concrete types, an attacker can craft JSON input containing arrays of non-allowlisted types (e.g., EvilType[]) that bypass the allowlist. During deserialization, the component types are instantiated directly without further validation, reintroducing the risk of gadget instantiation and arbitrary code execution that the validator is intended to prevent. This affects versions >=2.10.0 and <2.18.8, >=2.19.0 and <2.21.4, >=3.0.0 and <3.1.4, among others. The vulnerability has a CVSS v3.1 score of 8.1 (high severity) with network attack vector, high complexity, no privileges required, and impacts confidentiality, integrity, and availability. Red Hat has issued advisories and patches for affected products and recommends upgrading to versions 2.18.8, 2.21.4, or 3.1.4 or later. Alternative mitigations include removing allowIfSubTypeIsArray from ObjectMapper configurations and restricting polymorphic deserialization with strict whitelists.

This vulnerability allows attackers who can control JSON input to bypass the BasicPolymorphicTypeValidator's type allowlist by exploiting the array subtype allowlist bypass. This enables instantiation of arbitrary, non-allowlisted types during deserialization, potentially leading to arbitrary code execution. The impact affects confidentiality, integrity, and availability of affected systems using vulnerable jackson-databind versions with the flawed validator configuration. The vulnerability is rated high severity with a CVSS score of 8.1.

A fix is available in jackson-databind versions 2.18.8, 2.21.4, and 3.1.4 or later. Users should upgrade to these versions to remediate the vulnerability. If upgrading immediately is not feasible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the ObjectMapper configuration and rebuild/restart the application to eliminate the vulnerable deserialization path. Additionally, disable polymorphic deserialization of untrusted data where possible by avoiding default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is necessary, restrict allowed subtypes using a strict whitelist of trusted packages and avoid broad or permissive validation rules. Follow vendor advisories for detailed update instructions.