jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-54513 · GHSA-rmj7-2vxq-3g9f