What is the CVSS score of CVE-2026-54517?

CVE-2026-54517 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-54517?

Yes, a patch is available for CVE-2026-54517. Update the affected software to the latest version immediately.

jackson-databind CVE-2026-54517

EUVD-2026-38589 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-23 security-advisories@github.com

GHSA-5hh8-q8hv-fr38

Authentication Bypass Red Hat Jackson Databind Fasterxml

5.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

AC:H because exploitation requires three concurrent non-default application conditions: @JsonCreator constructor, setterless collection/map with @JsonView restriction, and view used as a security boundary.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 23, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 23, 2026 - 21:36 vuln.today

Analysis Generated

Jun 23, 2026 - 21:36 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5,224 maven packages depend on com.fasterxml.jackson.core:jackson-databind (1,712 direct, 3,569 indirect)
376 maven packages depend on tools.jackson.core:jackson-databind (106 direct, 270 indirect)

Ecosystem-wide dependent count for version 2.21.0 and other introduced versions.

DescriptionCVE.org

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.

AnalysisAI

@JsonView access-control bypass in jackson-databind 2.21.0-2.21.3 and 3.0.0-3.1.3 allows remote attackers to write values into setterless Collection/Map properties that are restricted by a @JsonView annotation, defeating view-based mass-assignment protection during deserialization. The regression was introduced when SetterlessProperty.isMerging() was changed to return true, routing these properties through an unguarded buffering branch in BeanDeserializer._deserializeUsingPropertyBased that lacked the prop.visibleInView(activeView) check applied to creator properties. No public exploit code has been identified and this is not listed in CISA KEV; however, applications relying on @JsonView for security-critical field-level access control - such as role or permission gating - are directly and completely bypassed.

Technical ContextAI

jackson-databind (Maven: com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind) is the core deserialization engine of the Jackson JSON processing stack, embedded in Spring, Quarkus, Dropwizard, and virtually every Java REST framework. The root cause is CWE-863 (Incorrect Authorization), with the related weakness CWE-1220 (Insufficient Granularity of Access Control) applying because the view filter was enforced on one code path but omitted from another. During property-based deserialization - triggered whenever a class uses a @JsonCreator constructor - BeanDeserializer._deserializeUsingPropertyBased buffers non-creator properties in a staging structure until the creator can be invoked. Before the fix, the view-exclusion guard (prop.visibleInView(activeView)) was present for creator properties but absent for the regular buffering branch. A separate upstream change that made SetterlessProperty.isMerging() return true enrolled setterless Collection/Map accessors into this unguarded buffering path, creating the vulnerability. The fix (commits 5bf23ed for 3.x, 94c5d21 for 2.21.x) inserts the missing visibleInView check immediately before the buffering step. CPE: cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* spanning versions 2.21.0-2.21.3 and 3.0.0-3.1.3.

RemediationAI

Upgrade jackson-databind to version 2.21.4 (for 2.21.x users) or 3.1.4 (for 3.x users); both are confirmed patched releases per GHSA advisory GHSA-5hh8-q8hv-fr38 at https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38. The upstream patch is a targeted one-line guard inserted into BeanDeserializer._deserializeUsingPropertyBased that skips and discards buffered properties not visible in the active view (commits 5bf23ed and 94c5d21 for the respective lines). If immediate library upgrade is not feasible, two compensating controls are available: first, replace @JsonView-based access control on setterless collection/map fields with explicit server-side DTO mapping or separate input/output model classes - this eliminates the security dependency on the flawed code path at the cost of additional model classes; second, enforce field-level authorization in service or controller logic independently of Jackson deserialization, so that even if restricted fields are populated by Jackson, the application layer discards or rejects them before use. Neither workaround is preferred over patching; both add maintenance burden and do not fix the underlying library defect.