CVE-2026-54517— jackson-databind: @JsonView bypass for setterless creator properties
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-54517
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
jackson-databind: @JsonView bypass for setterless creator properties
Source: NVD (National Vulnerability Database)
Vulnerability Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| FasterXML | jackson-databind | >= 2.21.0, < 2.21.4 | - |
II. Public POCs for CVE-2026-54517
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54517
请登录查看更多情报信息。
Other References for CVE-2026-54517 (5)
Same Patch Batch · FasterXML · 2026-06-23 · 8 CVEs total
| CVE-2026-54513 | 8.1 HIGH | jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIf |
| CVE-2026-54512 | 8.1 HIGH | jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbit |
| CVE-2026-54518 | 6.5 MEDIUM | jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind |
| CVE-2026-54516 | 5.3 MEDIUM | jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields |
| CVE-2026-54515 | 5.3 MEDIUM | jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProper |
| CVE-2026-54514 | 5.3 MEDIUM | jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) |
| CVE-2026-50193 | jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() |
IV. Related Vulnerabilities
Same product: jackson-databind
- CVE-2026-54518
jackson-databind: @JsonView bypass for unwrapped creator par - CVE-2026-50193
jackson-databind: Deeply nested JsonNode throws StackOverflo - CVE-2026-54512
jackson-databind: PolymorphicTypeValidator bypass via generi - CVE-2026-54513
jackson-databind: Array subtype allowlist bypass in BasicPol - CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers
Same vendor: FasterXML
- CVE-2026-54518
jackson-databind: @JsonView bypass for unwrapped creator par - CVE-2026-50193
jackson-databind: Deeply nested JsonNode throws StackOverflo - CVE-2026-54512
jackson-databind: PolymorphicTypeValidator bypass via generi - CVE-2026-54513
jackson-databind: Array subtype allowlist bypass in BasicPol - CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers
Same weakness: CWE-863
- CVE-2026-9640
LXD Snapshot Import Privilege Escalation Vulnerability - CVE-2026-54091
File Browser: Incorrect access control in public directory s - CVE-2026-54096
File Browser: Improper Access Control Occurs via Pre-Created - CVE-2026-54573
Authorization Bypass in API Key/OAuth Scopes via Path Parsin - CVE-2026-0934
Incorrect Authorization in GitLab
V. Comments for CVE-2026-54517
No comments yet