The array subtype allowlist defined in BasicPolymorphicTypeValidator when the allowIfSubTypeIsArray method is used. By providing a JSON payload that contains an array of a non‑allowlisted component type, the deserialization process will instantiate the component type directly without performing a further allowlist check. This bypass can lead to arbitrary class instantiation and, if the type contains code that is executed during deserialization, to remote code execution.

The affected library is FasterXML:jackson-databind. Versions susceptible to the flaw include all releases from 2.10.0 up to but not including 2.18.8, as well as the 2.21.x series before 2.21.4 and the 3.1.x series before 3.1.4. The vulnerability was fixed starting with 2.18.8, 2.21.4, and 3.1.4.

The CVSS score of 8.1 indicates a high severity. EPSS is not available, and the issue is not listed in CISA's KEV catalog. The likely attack vector involves any application that accepts JSON input and processes it with Jackson's polymorphic deserialization. An attacker who can send a crafted payload containing an array of an unallowlisted type can trigger the bypass and instantiate the type during deserialization, potentially enabling code execution on the target system.