CVE-2026-54517: jackson-databind Information Disclosure

CVE-2026-54517 Overview

CVE-2026-54517 is an authorization bypass vulnerability in jackson-databind, the data-binding component of the Jackson Data Processor for Java. The flaw affects versions 2.21.0 through 2.21.3 and 3.1.0 through 3.1.3. In BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter is applied only to creator properties. The regular property-buffering branch performs no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routes setterless Collection and Map properties through the unguarded path. Attacker-controlled JSON can populate setterless collections annotated with a restricted @JsonView, even when the active view excludes them.

Critical Impact
Attackers can inject data into restricted-view fields through JSON payloads, bypassing intended @JsonView access controls and causing limited integrity impact on applications relying on view-based deserialization filtering.

Affected Products

FasterXML jackson-databind versions 2.21.0 through 2.21.3
FasterXML jackson-databind versions 3.1.0 through 3.1.3
Java applications using @JsonView annotations on setterless Collection/Map properties

Discovery Timeline

2026-06-23 - CVE CVE-2026-54517 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54517

Vulnerability Analysis

The vulnerability stems from an incomplete authorization check in Jackson's bean deserialization pipeline. @JsonView is a Jackson annotation that lets developers restrict which fields are serialized or deserialized based on an active view context. Applications rely on this mechanism to enforce field-level access boundaries, such as exposing administrative fields only to privileged callers.

The _deserializeUsingPropertyBased method in BeanDeserializer handles JSON-to-object binding when constructor-based instantiation is required. The method contains two branches: one for creator properties bound to constructor arguments, and one that buffers regular properties for assignment after object construction. Only the creator branch invokes prop.visibleInView(activeView) to enforce the view filter.

This weakness aligns with CWE-863: Incorrect Authorization. The deserializer performs an access decision but applies it inconsistently across code paths.

Root Cause

A refactoring change made SetterlessProperty.isMerging() return true. Setterless Collection and Map properties — fields without explicit setters that Jackson populates by merging into the existing collection reference — were rerouted through the property-buffering branch. Because that branch never consults the active view, view-restricted setterless collections accept attacker input regardless of the configured @JsonView.

Attack Vector

An attacker sends crafted JSON to an endpoint that uses ObjectMapper.readerWithView() or equivalent view-scoped deserialization. The payload includes keys matching setterless Collection or Map fields annotated with a restricted @JsonView. The deserializer populates those fields despite the active view excluding them, allowing the attacker to write data the application assumed was protected.

text

// Source: https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962
  (reported by Omkhar A)
 #5967: Renamed `@JsonIgnore`d setters can deserialize via private fields
  (fixed by Omkhar A)
+#5969: `@JsonView` by-passed for some "setterless" creator properties
+ (fixed by Omkhar A)
 
 2.21.3 (28-Apr-2026)

The patch adds the missing visibleInView check to the buffered-property branch so the view filter is applied uniformly. See the GitHub Security Advisory GHSA-5hh8-q8hv-fr38 for full details.

Detection Methods for CVE-2026-54517

Indicators of Compromise

Inbound JSON payloads containing keys for fields the application documents as view-restricted, particularly Collection or Map types.
Unexpected mutations to setterless collection fields on deserialized DTOs after handling untrusted input.
Application logs showing populated @JsonView-restricted properties when the active view excludes them.

Detection Strategies

Inventory dependencies for jackson-databind versions in the affected ranges using software composition analysis tooling.
Audit code for @JsonView usage on setterless Collection and Map fields and review whether those fields are reachable from untrusted deserialization paths.
Add unit tests that submit JSON containing view-restricted property keys and assert the target fields remain empty after deserialization.

Monitoring Recommendations

Log and review request payloads to endpoints that invoke view-scoped deserialization for anomalous field names.
Track outbound dependency advisories from FasterXML and the GitHub Security Advisory feed for jackson-databind.
Alert on application errors or integrity check failures originating from controllers that rely on @JsonView filtering.

How to Mitigate CVE-2026-54517

Immediate Actions Required

Upgrade jackson-databind to version 2.21.4 for the 2.x branch or 3.1.4 for the 3.x branch.
Identify all uses of @JsonView on setterless Collection or Map properties exposed to untrusted JSON input.
Validate deserialized objects against expected business invariants before persisting or acting on them.

Patch Information

The fix is delivered in jackson-databind2.21.4 and 3.1.4. The patch restores the prop.visibleInView(activeView) check in the property-buffering branch of BeanDeserializer._deserializeUsingPropertyBased. Review the upstream commits 5bf23edb and 94c5d215, and the pull requests #5969 and #5970.

Workarounds

Replace setterless Collection and Map properties with explicit setters that enforce view checks in application code.
Remove @JsonView as the sole authorization boundary and apply server-side field validation after deserialization.
Restrict deserialization endpoints to authenticated, authorized callers until the upgrade is deployed.

bash

# Maven dependency upgrade example
<dependency>
  <groupId>com.fasterxml.jackson.core</groupId>
  <artifactId>jackson-databind</artifactId>
  <version>2.21.4</version>
</dependency>

# Gradle dependency upgrade example
implementation 'com.fasterxml.jackson.core:jackson-databind:3.1.4'