What is the CVSS score of CVE-2026-54518?

CVE-2026-54518 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-54518?

Yes, a patch is available for CVE-2026-54518. Update the affected software to the latest version immediately.

jackson-databind CVE-2026-54518

Q: Which versions of jackson-databind are affected by CVE-2026-54518?

Jackson-databind's `@JsonView` authorization boundary is bypassed for constructor parameters that combine `@JsonUnwrapped` and `@JsonView` annotations, affecting versions 2.21.0-2.21.3 and…. A patch is available.

EUVD-2026-38629 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-23 https://github.com/FasterXML/jackson-databind

GHSA-rcqc-6cw3-h962

Authentication Bypass Red Hat

6.5

CVSS 3.1 · Vendor: https://github.com/FasterXML/jackson-databind

Severity by source

Vendor (https://github.com/FasterXML/jackson-databind) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.3 MEDIUM

AV:N because attacker delivers JSON over the network; PR:N at the library layer; I:L for unauthorized writes to view-restricted fields; C:N because deserialization itself does not expose data to the attacker.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/FasterXML/jackson-databind).

CVSS VectorVendor: https://github.com/FasterXML/jackson-databind

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 21:51 vuln.today

Analysis Generated

Jun 23, 2026 - 21:51 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5,234 maven packages depend on com.fasterxml.jackson.core:jackson-databind (1,712 direct, 3,579 indirect)
377 maven packages depend on tools.jackson.core:jackson-databind (106 direct, 271 indirect)

Ecosystem-wide dependent count for version 2.21.0 and other introduced versions.

DescriptionCVE.org

Summary

UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active.

Impact

View-restricted unwrapped creator parameters can be set from untrusted input where @JsonView is used as a write-side authorization boundary.

Affected / Patched (verified via `git tag --contains`)

2.21 line: >= 2.21.0, < 2.21.4 -> fixed in 2.21.4 (backport 721fa07, #5973)
3.x line: >= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5971, d633bc0)

Severity / CWE

Maintainer: minor. Reporter: HIGH. CWE-863 (Incorrect Authorization); related CWE-284.

Credits

Omkhar Arasaratnam (@omkhar) - finder.

AnalysisAI

Jackson-databind's @JsonView authorization boundary is bypassed for constructor parameters that combine @JsonUnwrapped and @JsonView annotations, affecting versions 2.21.0-2.21.3 and 3.0.0-3.1.3. The deserialization code path in UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters without calling prop.visibleInView(activeView), while the standard property path correctly enforces this check. Applications that rely on @JsonView as a write-side access control boundary are exposed: an attacker supplying crafted JSON can populate admin-restricted constructor fields even when the application activates a less-privileged view. No public exploit identified at time of analysis; upstream patches are confirmed in 2.21.4 and 3.1.4.

Technical ContextAI

jackson-databind (Maven: com.fasterxml.jackson.core:jackson-databind / tools.jackson.core:jackson-databind) is Jackson's core data binding library, pervasive in Java web applications particularly via Spring Boot. @JsonView is a Jackson annotation that gates serialization and deserialization of individual properties to named view classes, and some applications use it as a lightweight write-side authorization control - for example, restricting admin-only fields from being set via public API payloads. @JsonUnwrapped causes a nested object's fields to be inlined into the parent JSON object. When both annotations appear on a @JsonCreator constructor parameter, deserialization takes a special replay path in UnwrappedPropertyHandler.processUnwrappedCreatorProperties(). The patch (PR #5971, commit d633bc0 for 3.x; PR #5973, commit 721fa07 for 2.21.x) adds a guard: it fetches ctxt.getActiveView() and skips any creator property whose visibleInView(activeView) check fails, matching the behavior of the normal property path. CWE-863 (Incorrect Authorization) is the root cause - the authorization check exists in the codebase but is missing from one specific code path.

RemediationAI

Upgrade jackson-databind to 2.21.4 or later on the 2.21.x line, or to 3.1.4 or later on the 3.x line; these versions are confirmed fixed per git tag evidence cited in the GitHub advisory (GHSA-rcqc-6cw3-h962). For teams unable to upgrade immediately, the primary compensating control is to remove reliance on @JsonView as a write-side (deserialization) security gate for any class that combines @JsonCreator, @JsonUnwrapped, and @JsonView on the same constructor parameter - enforce those access restrictions at the controller or service layer instead, using conditional checks or separate DTO classes per privilege level. This avoids the vulnerable code path entirely with no functional regression. Alternatively, eliminate @JsonUnwrapped from @JsonView-annotated creator parameters and represent nested objects via explicit keys, which routes deserialization through the standard property path that correctly enforces view checks. Do not rely on ObjectMapper view filtering alone as a security boundary until patched.