CVE-2026-54517

Katalog CVE

CVSS 5.3 · Medium EPSS 0,38%

Kerentanan Incorrect Authorization pada fasterxml jackson-databind. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

27 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38 advisory vendor
• https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d patch
• https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962 patch
• https://github.com/FasterXML/jackson-databind/pull/5969 issue tracking · patch
• https://github.com/FasterXML/jackson-databind/pull/5970 issue tracking · patch