CVE-2026-54517: FasterXML jackson-databind @JsonView bypass in BeanDeserializer

CVE-2026-54517 · Severity: medium · CVSS 5.3 · Published 2026-06-23

Jackson-databind is a popular Java library used to convert data between JSON and Java objects. A flaw in how it handles data restrictions allows attackers to modify sensitive information, such as administrative settings or internal lists, even when those fields are marked as restricted. This could lead to unauthorized data changes or 'mass-assignment' attacks where an attacker updates fields they should not have access to.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-54517 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54517 being exploited in the wild.
How severe is CVE-2026-54517?
Medium severity, with a CVSS score of 5.3, published 23 June 2026.
Which products and versions are affected?
FasterXML Jackson Databind >= 2.21.0, < 2.21.4; >= 3.0.0, < 3.1.4; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.21.0,fixed=2.21.4; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.4.
Is there a fix for CVE-2026-54517?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.4 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54517 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54517?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.4 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.21.4 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later
    # set tools.jackson.core:jackson-databind to 3.1.4 in your pom.xml or build.gradle

Technical details

A vulnerability exists in jackson-databind's BeanDeserializer._deserializeUsingPropertyBased where @JsonView filters are incorrectly applied. While creator properties were properly filtered, the regular property-buffering branch lacked a visibility check. Due to a change where SetterlessProperty.isMerging() returns true, setterless Collection and Map properties are routed through this unguarded path. An attacker can exploit this by providing JSON input for fields that should be excluded by the active view, leading to an incorrect authorization (CWE-863) or mass-assignment vulnerability. The issue is fixed in versions 2.21.4 and 3.1.4.

Affected products

  • FasterXML jackson-databind >= 2.21.0, < 2.21.4
  • FasterXML jackson-databind >= 3.0.0, < 3.1.4

Identifiers

  • CVE-2026-54517
  • GHSA-5hh8-q8hv-fr38

Timeline

  • 2026-05-06: patched: Fix merged into 3.x branch
  • 2026-05-07: patched: Fix backported to 2.21 branch
  • 2026-06-16: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.