Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-54517 JSON View Filter Bypass in Jackson-databind 2.21.0-2.21.3 and 3.1.0-3.1.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54517
Post summary
The post announces CVE-2026-54517, specifying a JSON View Filter Bypass in Jackson-databind across multiple versions, but lacks additional details such as PoC, exploit code, active exploitation evidence, or a patch.
🟠 Jackson-databind @JsonView Bypass via Setterless Properties, #CVE-2026-54517 (Medium) -DC-Jun2026-604 https://dailycve.com/jackson-databind-jsonview-bypass-via-setterless-properties-cve-2026-54517-medium-dc-jun2026-604/
Post summary
The tweet announces the new CVE-2026-54517, highlighting a medium‑severity @JsonView bypass in Jackson‑databind that employs setterless properties.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fasterxml | jackson-databind | - | - | - |