Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-54517 EUVD-2026-38589GHSA-5hh8-q8hv-fr38

jackson-databind: @JsonView bypass for setterless creator properties

Published Jun 23, 2026 · Updated Jun 24, 2026 · Assigned by GitHub_M

Vendor: FasterXML Product: jackson-databind Package: akhq Package: apache-nifi Package: apache-tika-3.2 Package: apache-tika-3.2-compat Package: apache-tika-3.3 Package: apicurio-registry Package: cassandra-4.1 Package: com.fasterxml.jackson.core:jackson-databind Package: confluent-kafka Package: dependency-track Package: dependency-track-bundled Package: druid Package: flyway Package: infinispan-16.1 Package: jackson-databind Package: jackson-databind Package: jenkins-2-openjdk-21 Package: jenkins-2-openjdk-25 Package: jenkins-plugin-manager Package: kafka-4.1 Package: kafka-4.2 Package: keycloak-26.5 Package: keycloak-26.5-iamguarded-compat Package: keycloak-26.5-operator Package: keycloak-26.6 Package: keycloak-26.6-iamguarded-compat Package: keycloak-26.6-operator Package: keycloak-config-cli Package: keycloak-config-cli-iamguarded-compat Package: logstash-9.3 Package: logstash-9.3-iamguarded-compat Package: logstash-9.4 Package: logstash-9.4-iamguarded-compat Package: management-api-for-apache-cassandra-5.0 Package: neo4j-2026.05 Package: nextflow Package: opensearch-3 Package: opensearch-3-alerting Package: opensearch-3-anomaly-detection Package: opensearch-3-crypto-kms Package: opensearch-3-discovery-ec2 Package: opensearch-3-iamguarded-compat Package: opensearch-3-ml-commons Package: opensearch-3-neural-search Package: opensearch-3-notifications Package: opensearch-3-observability Package: opensearch-3-performance-analyzer Package: opensearch-3-reporting Package: opensearch-3-repository-azure Package: opensearch-3-repository-s3 Package: opensearch-3-security Package: opensearch-3-sql Package: ruby3.2-jrjackson Package: ruby3.3-jrjackson Package: ruby3.4-jrjackson Package: ruby4.0-jrjackson Package: scala-3.8 Package: solr-10 Package: solr-10-iamguarded-compat Package: sonarqube Package: spark-4.0-scala-2.13 Package: spark-4.1-scala-2.13 Package: spdx-tools-java Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: strimzi-kafka-operator-v1-api-conversion Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: tools.jackson.core:jackson-databind Package: trino Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.

Affected products

VendorProductAffectedFixed
FasterXML jackson-databind >= 2.21.0, < 2.21.4, >= 3.0.0, < 3.1.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jackson-databind No fix yet —
Debian 13 jackson-databind No fix yet —
Debian 12 jackson-databind No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jackson-databind No fix yet —
Ubuntu 26.04 LTS jackson-databind No fix yet —
Ubuntu 25.10 jackson-databind No fix yet —
Ubuntu 24.04 LTS jackson-databind No fix yet —
Ubuntu 22.04 LTS jackson-databind No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS jackson-databind No fix yet —
Ubuntu 18.04 LTS jackson-databind No fix yet —
Ubuntu Pro 16.04 LTS jackson-databind No fix yet —
Ubuntu Pro 14.04 LTS jackson-databind No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.28.0-r1 —
Wolfi rolling apache-nifi No fix yet —
Wolfi rolling apache-tika-3.2 3.2.3-r13 —
Wolfi rolling apache-tika-3.2-compat 3.2.3-r18 —
Wolfi rolling apache-tika-3.3 3.3.1-r5 —
Wolfi rolling apicurio-registry 3.3.0-r6 —
Wolfi rolling cassandra-4.1 4.1.11-r1 —
Wolfi rolling confluent-kafka 8.4.0.253-r2 —
Wolfi rolling dependency-track +1 4.14.2-r3 —
Wolfi rolling druid 37.0.0-r19 —
Wolfi rolling flyway 12.9.0-r1 —
Wolfi rolling infinispan-16.1 16.1.4-r5 —
Wolfi rolling jenkins-2-openjdk-21 +1 2.572-r0 —
Wolfi rolling jenkins-plugin-manager 2.15.0-r4 —
Wolfi rolling kafka-4.1 4.1.2-r3 —
Wolfi rolling kafka-4.2 4.2.1-r3 —
Wolfi rolling keycloak-26.5 +2 26.5.7-r8 —
Wolfi rolling keycloak-26.6 +2 26.6.4-r1 —
Wolfi rolling keycloak-config-cli +1 6.5.1-r5 —
Wolfi rolling logstash-9.3 +1 9.3.7-r0 —
Wolfi rolling logstash-9.4 +1 9.4.2-r7 —
Wolfi rolling management-api-for-apache-cassandra-5.0 0.1.122-r1 —
Wolfi rolling neo4j-2026.05 2026.05.0-r4 —
Wolfi rolling nextflow 26.04.4-r1 —
Wolfi rolling opensearch-3 +14 3.7.0-r2 —
Wolfi rolling opensearch-3-iamguarded-compat 3.8.0-r3 —
Wolfi rolling ruby3.2-jrjackson +2 0.5.2-r0 —
Wolfi rolling ruby4.0-jrjackson 0.5.0-r1 —
Wolfi rolling scala-3.8 3.8.4-r4 —
Wolfi rolling solr-10 +1 10.0.0-r6 —
Wolfi rolling sonarqube 26.8.0.126808-r0 —
Wolfi rolling spark-4.0-scala-2.13 4.0.4-r8 —
Wolfi rolling spark-4.1-scala-2.13 4.1.2-r5 —
Wolfi rolling spdx-tools-java 2.0.6-r5 —
Wolfi rolling strimzi-kafka-operator-kafka-init +6 1.0.1-r2 —
Wolfi rolling thingsboard-tb-node +1 4.3.1.2-r12 —
Wolfi rolling trino +53 482-r0 —
Wolfi rolling trino-plugin-teradata-functions 483-r7 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.fasterxml.jackson.core:jackson-databind >= 2.21.0, < 2.21.4 2.21.4 GHSA-5hh8-q8hv-fr38
Maven com.fasterxml.jackson.core:jackson-databind >= 3.0.0, < 3.1.4 3.1.4 GHSA-5hh8-q8hv-fr38
Maven tools.jackson.core:jackson-databind >= 3.0.0, < 3.1.4 3.1.4 GHSA-5hh8-q8hv-fr38

Advisories 2

References