# CVE-2026-54517: FasterXML jackson-databind @JsonView bypass in BeanDeserializer

Source: https://junglewise.ai/threats/cve-2026-54517-fasterxml-jackson-databind-jsonview-bypass-in-beandeserializer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-54517 · Severity: medium · CVSS 5.3 · Published 2026-06-23

Jackson-databind is a popular Java library used to convert data between JSON and Java objects. A flaw in how it handles data restrictions allows attackers to modify sensitive information, such as administrative settings or internal lists, even when those fields are marked as restricted. This could lead to unauthorized data changes or 'mass-assignment' attacks where an attacker updates fields they should not have access to.

Technologies: [FasterXML Jackson Databind](https://junglewise.ai/threats/technologies/jackson-databind), [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind), [tools.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/tools-jackson-core-jackson-databind). Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-54517 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54517 being exploited in the wild.

**How severe is CVE-2026-54517?** Medium severity, with a CVSS score of 5.3, published 23 June 2026.

**Which products and versions are affected?** FasterXML Jackson Databind >= 2.21.0, < 2.21.4; >= 3.0.0, < 3.1.4; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.21.0,fixed=2.21.4; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.4.

**Is there a fix for CVE-2026-54517?** Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.4 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54517 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54517?** Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.4 or later

  ```sh
  # set com.fasterxml.jackson.core:jackson-databind to 2.21.4 in your pom.xml or build.gradle
  ```

- tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later

  ```sh
  # set tools.jackson.core:jackson-databind to 3.1.4 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in jackson-databind's BeanDeserializer._deserializeUsingPropertyBased where @JsonView filters are incorrectly applied. While creator properties were properly filtered, the regular property-buffering branch lacked a visibility check. Due to a change where SetterlessProperty.isMerging() returns true, setterless Collection and Map properties are routed through this unguarded path. An attacker can exploit this by providing JSON input for fields that should be excluded by the active view, leading to an incorrect authorization (CWE-863) or mass-assignment vulnerability. The issue is fixed in versions 2.21.4 and 3.1.4.

## Affected products

- FasterXML jackson-databind >= 2.21.0, < 2.21.4
- FasterXML jackson-databind >= 3.0.0, < 3.1.4

## Identifiers

- CVE-2026-54517
- GHSA-5hh8-q8hv-fr38

## Timeline

- 2026-05-06: patched: Fix merged into 3.x branch
- 2026-05-07: patched: Fix backported to 2.21 branch
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD

## References

- [https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d](https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d)
- [https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962](https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962)
- [https://github.com/FasterXML/jackson-databind/pull/5969](https://github.com/FasterXML/jackson-databind/pull/5969)
- [https://github.com/FasterXML/jackson-databind/pull/5970](https://github.com/FasterXML/jackson-databind/pull/5970)
- [https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38)

## Related threats

- [jackson-databind type validation bypass in generic arguments](https://junglewise.ai/threats/cve-2026-110879-jackson-databind-validates-the-outer-class-of-a-class-name-type)
- [Jackson Protobuf Parser integer overflow in string key parsing](https://junglewise.ai/threats/cve-2026-110747-protobufparser-readstringkey-reads-the-length-prefix-of-a)
- [jackson-databind quadratic complexity in forward-reference resolution](https://junglewise.ai/threats/cve-2026-91777-jackson-databind-quadratic-forward-reference-completion)
- [FasterXML Jackson Databind unbounded cache growth on unknown type IDs](https://junglewise.ai/threats/cve-2026-91776-jackson-databind-retains-every-unknown-raw-type-id)
- [FasterXML jackson-databind quadratic parse in XML datatype deserialization](https://junglewise.ai/threats/cve-2026-68497-fasterxml-jackson-databind-quadratic-parse-in-xml-datatype)