{"id":"CVE-2026-54517","aliases":["DEBIAN-CVE-2026-54517","EUVD-2026-38589","GHSA-5hh8-q8hv-fr38","ROOT-APP-MAVEN-CVE-2026-54517","UBUNTU-CVE-2026-54517"],"status":"published","title":"jackson-databind: @JsonView bypass for setterless creator properties","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00384,"percentile":0.32752,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-06-23T20:47:22Z","modified":"2026-10-28T11:09:54Z","fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.21.4","3.1.4"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.21.2-aikido.2","2.21.1-aikido.2","2.21.2-aikido.3","3.1.1-aikido.2","2.21.1-aikido.3","2.21.1-aikido.4","2.21.2-aikido.4","2.21.2-aikido.5","2.21.4-aikido.1","2.21.4-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.1-aikido.3","3.1.0-aikido.3","3.1.1-aikido.4","3.1.0-aikido.4","3.1.0-aikido.5","3.1.1-aikido.5","3.1.4-aikido.2","3.1.4-aikido.3","3.1.4-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.21.2-root.io.2","2.21.1-root.io.2","2.21.2-root.io.3","3.1.1-root.io.2","2.21.1-root.io.3","2.21.1-root.io.4","2.21.2-root.io.4","2.21.2-root.io.5","2.21.4-root.io.1","2.21.4-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-databind","fixed_in":["3.1.1-root.io.3","3.1.0-root.io.3","3.1.1-root.io.4","3.1.0-root.io.4","3.1.0-root.io.5","3.1.1-root.io.5","3.1.4-root.io.2","3.1.4-root.io.3","3.1.4-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.21.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3","2.14.0-1","2.14.0-1+deb12u1","2.18.11-1","2.22.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1+deb13u1","2.14.0+ds-2","2.14.0+ds-3","2.18.11-1","2.22.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3","2.18.11-1","2.22.4-1"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.21.4"}]}],"versions":["2.21.0","2.21.1","2.21.2","2.21.3"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3"]},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.2-aikido.2"},{"fixed":"2.21.1-aikido.2"},{"fixed":"2.21.2-aikido.3"},{"fixed":"3.1.1-aikido.2"},{"fixed":"2.21.1-aikido.3"},{"fixed":"2.21.1-aikido.4"},{"fixed":"2.21.2-aikido.4"},{"fixed":"2.21.2-aikido.5"},{"fixed":"2.21.4-aikido.1"},{"fixed":"2.21.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-aikido.3"},{"fixed":"3.1.0-aikido.3"},{"fixed":"3.1.1-aikido.4"},{"fixed":"3.1.0-aikido.4"},{"fixed":"3.1.0-aikido.5"},{"fixed":"3.1.1-aikido.5"},{"fixed":"3.1.4-aikido.2"},{"fixed":"3.1.4-aikido.3"},{"fixed":"3.1.4-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.2-root.io.2"},{"fixed":"2.21.1-root.io.2"},{"fixed":"2.21.2-root.io.3"},{"fixed":"3.1.1-root.io.2"},{"fixed":"2.21.1-root.io.3"},{"fixed":"2.21.1-root.io.4"},{"fixed":"2.21.2-root.io.4"},{"fixed":"2.21.2-root.io.5"},{"fixed":"2.21.4-root.io.1"},{"fixed":"2.21.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-root.io.3"},{"fixed":"3.1.0-root.io.3"},{"fixed":"3.1.1-root.io.4"},{"fixed":"3.1.0-root.io.4"},{"fixed":"3.1.0-root.io.5"},{"fixed":"3.1.1-root.io.5"},{"fixed":"3.1.4-root.io.2"},{"fixed":"3.1.4-root.io.3"},{"fixed":"3.1.4-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-1","2.2.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2","2.4.2-3","2.4.2-3ubuntu0.1~esm1","2.4.2-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.5-1","2.9.8-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.9.3-1","2.10.0-2","2.10.1-1","2.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.12.5-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1build1","2.14.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1build1"]}],"products":[{"vendor":"fasterxml","product":"jackson-databind"}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5969","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5970","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54517","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5hh8-q8hv-fr38"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54517.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54517","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-54517","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54517","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-54517","title":"jackson-databind: @JsonView bypass for setterless creator properties","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.","status":"published","published":"2026-06-23T20:47:22.977Z","modified":"2026-06-24T19:13:32.607Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-38589","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.","status":"published","published":"2026-06-23T20:47:22Z","modified":"2026-06-24T19:13:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:30.242414Z"}],"ghsa":[{"id":"GHSA-5hh8-q8hv-fr38","title":"jackson-databind has @JsonView bypass for setterless creator properties","description":"## Summary\nIn `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to creator properties; the regular property-buffering branch performed no `prop.visibleInView(activeView)` check. A change making `SetterlessProperty.isMerging()` return `true` routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted `@JsonView` is populated from attacker JSON even when the active view excludes it.\n\n## Impact\nView-restricted (e.g. admin-only) setterless collection/map properties can be written from untrusted JSON despite `@JsonView` gating — an access-control / mass-assignment bypass. No RCE or DoS.\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.21 line: `\u003e= 2.21.0, \u003c 2.21.4` -\u003e fixed in **2.21.4** (backport `94c5d21`, #5970)\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4** (#5969, `5bf23ed`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: HIGH. CWE-863 (Incorrect Authorization); related CWE-1220.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","status":"published","published":"2026-06-23T21:24:50Z","modified":"2026-07-20T21:21:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:40:47.245721Z"}],"nvd":[{"id":"CVE-2026-54517","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.","status":"published","published":"2026-06-23T21:17:02.853Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"CVE-2026-54517","title":"jackson-databind: @JsonView bypass for setterless creator properties","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.","status":"published","published":"2026-06-23T20:47:22.977Z","modified":"2026-10-28T11:09:54.663586929Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54517","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.","status":"published","published":"2026-06-23T21:17:02.853Z","modified":"2026-10-26T12:02:22.487277155Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-5hh8-q8hv-fr38","title":"jackson-databind has @JsonView bypass for setterless creator properties","description":"## Summary\nIn `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to creator properties; the regular property-buffering branch performed no `prop.visibleInView(activeView)` check. A change making `SetterlessProperty.isMerging()` return `true` routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted `@JsonView` is populated from attacker JSON even when the active view excludes it.\n\n## Impact\nView-restricted (e.g. admin-only) setterless collection/map properties can be written from untrusted JSON despite `@JsonView` gating — an access-control / mass-assignment bypass. No RCE or DoS.\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.21 line: `\u003e= 2.21.0, \u003c 2.21.4` -\u003e fixed in **2.21.4** (backport `94c5d21`, #5970)\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4** (#5969, `5bf23ed`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: HIGH. CWE-863 (Incorrect Authorization); related CWE-1220.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","status":"published","published":"2026-06-23T21:24:50Z","modified":"2026-09-10T03:51:07.997389778Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"UBUNTU-CVE-2026-54517","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.","status":"published","published":"2026-06-23T21:17:00Z","modified":"2026-10-17T12:59:06.220351318Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-54517","title":"CVE-2026-54517 in com.fasterxml.jackson.core:jackson-databind - Patched by Root","description":"Root has patched CVE-2026-54517 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-16T07:51:03Z","modified":"2026-10-16T08:15:10.190086485Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}