Data-binding Vulnerability in jackson-databind by FasterXML
CVE-2026-54518
6.5MEDIUM
What is CVE-2026-54518?
The jackson-databind library, used for data-binding in JSON processing, has a flaw that allows unwrapped properties to be populated from attacker-controlled JSON without proper visibility checks. This occurs because the method UnwrappedPropertyHandler.processUnwrappedCreatorProperties() incorrectly replays buffered JSON into constructor parameters, bypassing visibility conditions defined by @JsonView. This issue affects versions 2.21.0 to 2.21.4 and 3.1.4 and poses a risk by allowing unauthorized data to be processed when a restrictive view is active. Update to versions 2.21.4 or 3.1.4 to mitigate this vulnerability.
Affected Version(s)
jackson-databind >= 2.21.0, < 2.21.4 < 2.21.0, 2.21.4
jackson-databind >= 3.0.0, < 3.1.4 < 3.0.0, 3.1.4