CVE-2026-54517

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3

Description In the BeanDeserializer. deserializeUsingPropertyBased() function, the active-view (@JsonView) filter was applied only to creator properties, while the regular property-buffering branch lacked a prop.visibleInView(activeView) check. Due to a change where SetterlessProperty.isMerging() returns true, setterless Collection or Map properties are routed through this unguarded path. This allows setterless collections annotated with a restricted @JsonView to be populated from untrusted JSON even when the active view excludes them, resulting in an access-control or mass-assignment bypass where view-restricted properties can be written.

Recommendations Update to version 2.21.4 Update to version 3.1.4