jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) (CVE-2026-54513) | HOL Guard CVE