Jackson

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 11 Last 12 months 80 Lifetime Unsafe deserialization 45 % Type validation bypass 25 % Denial of service 20 % Information disclosure 10 % Latest advisories Loading the feed Overview Jackson is the JSON layer of the Java ecosystem. Spring Boot, Elasticsearch clients, the AWS SDK and most of the Hadoop stack bind untrusted JSON to Java objects through jackson-databind, so its behaviour decides what an attacker-controlled document can instantiate. CVE-2026-54513 is the reference point: an array subtype slipped past the allowlist in BasicPolymorphicTypeValidator, the control that exists specifically to stop gadget chains. Reports route to a Tidelift security contact or to FasterXML directly, and Tidelift pays maintainers to triage rather than paying the reporter, so a finding here earns nothing upstream. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published SECURITY.md documents coordinated disclosure with the Tidelift security contact as the recommended route and [email protected] as the alternate, and asks that details stay out of public issues. It draws no boundary narrower than the project jackson-databind in full: the ObjectMapper, deserializer resolution, bean property binding, creator selection and the reflection that instantiates a class named by a document Polymorphic type handling end to end: default typing, @JsonTypeInfo , type id resolution and every subtype validator including BasicPolymorphicTypeValidator jackson-core: the streaming parser and generator, number and string handling, buffer management and the recycler underneath them Annotation semantics wherever an annotation changes which class can be constructed or which property can be set The dataformat modules the project maintains, where XML, YAML, CBOR or another encoding reaches the same databind layer through a different front end The datatype modules, where a deserializer builds a JDK or third-party object from document-controlled values Configuration defaults, including what a mapper does when an application enables nothing in particular Out of scope Gadget classes in third-party libraries. The gadget belongs to that library; the report here is that Jackson's validation failed to stop it Applications that enable default typing over untrusted input and then bind to a permissive base type, where Jackson behaved exactly as configured and documented Anything filed as a public issue, which the policy asks reporters to avoid Long-superseded releases where the fix has been available for years and the finding is simply that an old version is old Upstream dependency vulnerabilities, unless Jackson's own use of the dependency is what makes them reachable Most-valued findings Polymorphic type validator bypass above everything else. CVE-2026-54513 reached a blocked type through an array subtype, and any other shape that gets past BasicPolymorphicTypeValidator is the highest-value finding on this target Any route that makes Jackson instantiate a class the configuration should have refused, whether through a type id, a creator, a property setter or a nested generic Deserialization denial of service: deep nesting, enormous numbers, or a document that drives quadratic work in the databind layer Defects in the streaming parser's buffer handling in jackson-core, particularly the recycler, where the consequence crosses request boundaries in a server Non-JSON front ends reaching the same binding, since an XML or YAML document that produces the same instantiation is the same bug with a wider delivery surface Information disclosure through error handling, where a failed bind returns internal type or path detail to a remote caller Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Use the Tidelift security contact, the route the SECURITY.md recommends, or [email protected] as the alternate. GitHub private vulnerability reporting is also enabled on the repo Tidelift coordinates and does not pay reporters. It acknowledges within two business days and consults on a disclosure date; there is no bounty behind that door The policy asks that details stay out of public issues, so hold the write-up until the advisory is out Give the exact Jackson version and the module. A finding in jackson-databind is a different report from one in jackson-core or a dataformat module Attach a minimal JSON document and the mapper configuration that reproduces it. State whether default typing is enabled, since that single flag changes the severity argument entirely For a validator bypass, name the class you reached and show that the configured allowlist should have refused it Disclosure Coordinated privately through Tidelift or FasterXML and published as a GitHub Security Advisory against the affected module, with a fixed release on the current 2.x line. The 2026 record shows advisories going out in clusters, with batches on 23 June and 21 July, so plan for an embargo that runs to the next patch release rather than to a fixed day count. Credit is recorded in the advisory. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability