Data Binding Vulnerability in Jackson Databind by FasterXML
CVE-2026-54517
5.3MEDIUM
What is CVE-2026-54517?
The Jackson Databind library from FasterXML contains a vulnerability that affects specific versions, resulting from improper handling of the active-view (@JsonView) filter in the BeanDeserializer._deserializeUsingPropertyBased method. This oversight allows unguarded access to setterless Collection/Map properties, enabling attackers to manipulate the underlying data structures via malicious JSON inputs, even when such properties should be excluded based on the active view restrictions. Users should upgrade to the patched versions (2.21.4 and 3.1.4) to mitigate this risk.
Affected Version(s)
jackson-databind >= 2.21.0, < 2.21.4 < 2.21.0, 2.21.4
jackson-databind >= 3.0.0, < 3.1.4 < 3.0.0, 3.1.4