5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54517

CVE-2026-54517: jackson-databind: @JsonView bypass for setterless creator properties

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54517

CVE-2026-54517:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.fasterxml.jackson.core:jackson-databind	maven	>= 2.21.0, < 2.21.4	2.21.4
com.fasterxml.jackson.core:jackson-databind	maven	>= 3.0.0, < 3.1.4	3.1.4
tools.jackson.core:jackson-databind	maven	>= 3.0.0, < 3.1.4	3.1.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-5hh8-q8hv-fr38, is an authorization bypass in jackson-databind's @JsonView mechanism. The root cause lies within the _deserializeUsingPropertyBased method of the BeanDeserializer class. When deserializing JSON for objects that use a property-based creator (e.g., a constructor with @JsonCreator), this method handles the process. The flaw was that for properties not included in the creator, the code path that buffers these properties for later assignment was missing a crucial check to validate if the property should be visible according to the active @JsonView.

An attacker can exploit this by sending a JSON object containing fields that are meant to be excluded from a specific view (e.g., admin-only fields). When the application deserializes this JSON using a more restrictive view, the vulnerable method incorrectly processes and populates the restricted fields, leading to a mass assignment vulnerability.

The analysis of the fixing commits (94c5d21 for the 2.x branch and 5bf23ed for the 3.x branch) confirms this. Both patches introduce the same logic: an explicit check !prop.visibleInView(activeView) is added to the property-buffering section of _deserializeUsingPropertyBased. This ensures that properties are filtered based on the active view before being buffered, closing the security gap. The two different package names (com.fasterxml.jackson.databind and tools.jackson.databind) correspond to the different major versions of the library, hence two vulnerable functions are listed.

Vulnerable functions

com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased

src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializer.java

The vulnerability is in the `_deserializeUsingPropertyBased` method, which fails to check if a property is visible in the active `@JsonView` before buffering it for later processing. This allows an attacker to populate view-restricted setterless properties (like collections or maps) by sending them in the JSON input, bypassing the intended access control.

tools.jackson.databind.deser.bean.BeanDeserializer._deserializeUsingPropertyBased

src/main/java/tools/jackson/databind/deser/bean/BeanDeserializer.java

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.