Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-06-23T20:47:22
jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-1220
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.
A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability due to an issue in how active-view (@JsonView) filters are applied. Specifically, setterless collections annotated with a restricted @JsonView can be populated from attacker-controlled JSON even when the active view is configured to exclude them. This can lead to information disclosure, allowing an attacker to access data that should otherwise be restricted.
Moderate: A flaw in jackson-databind allows for information disclosure and an access-control bypass. This occurs because the `@JsonView` filter, intended to restrict data visibility, is not correctly applied to setterless collection and map properties during deserialization. An attacker could exploit this to populate view-restricted properties from untrusted JSON, potentially accessing sensitive data that should be excluded by the active view.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Cryostat 4
Fix deferred
jackson-databind
OpenShift Developer Tools and Services
Fix deferred
jenkins
OpenShift Developer Tools and Services
Fix deferred
jenkins-2-plugins
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel8
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-dispatcher-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-receiver-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-gaudi-rhel9
Red Hat AMQ Broker 7
Fix deferred
jackson-databind
Red Hat AMQ Clients
Fix deferred
jackson-databind
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
python3.11-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3.12-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3x-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python-drools-jpy-jar
Red Hat build of Apache Camel 4 for Quarkus 3
Fix deferred
jackson-databind
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
jackson-databind
Red Hat build of Apache Camel - HawtIO 4
Fix deferred
jackson-databind
Red Hat build of Apicurio Registry 3
Fix deferred
jackson-databind
Red Hat build of Debezium 3
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9-operator
Red Hat Build of Keycloak
Fix deferred
rhbk-openshift-rhel9/rhbk-openshift-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk-rhel9-operator/rhbk-rhel9-operator
Red Hat build of Quarkus
Affected
jackson-databind
Red Hat Certificate System 10
Fix deferred
redhat-pki:10/redhat-pki
Red Hat Data Grid 8
Fix deferred
jackson-databind
Red Hat Enterprise Linux 10
Not affected
dogtag-pki
Red Hat Enterprise Linux 8
Not affected
pki-deps:10.6/jackson-databind
Red Hat Enterprise Linux 9
Not affected
jackson-databind
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gaudi-rhel9
Red Hat Fuse 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 8
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform Expansion Pack
Fix deferred
jackson-databind
Red Hat Lightspeed for Runtimes Operator
Fix deferred
rh-lightspeed-runtimes/runtimes-agent-init-rhel9
Red Hat Offline Knowledge Portal
Fix deferred
offline-knowledge-portal/rhokp-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-modelmesh-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-spark-operator-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-trustyai-service-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/multicluster-redirector-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/pluginregistry-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/server-rhel9
Red Hat Satellite 6
Fix deferred
candlepin
Red Hat Satellite 6
Fix deferred
openvox-server
Red Hat Satellite 6
Fix deferred
puppetserver
Red Hat Satellite 6
Fix deferred
satellite:el8/candlepin
Red Hat Satellite 6
Fix deferred
satellite:el8/puppetserver
Red Hat Single Sign-On 7
Fix deferred
jackson-databind
streams for Apache Kafka 2
Fix deferred
jackson-databind
streams for Apache Kafka 3
Fix deferred
jackson-databind
https://www.cve.org/CVERecord?id=CVE-2026-54517
https://nvd.nist.gov/vuln/detail/CVE-2026-54517
https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d
https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962
https://github.com/FasterXML/jackson-databind/pull/5969
https://github.com/FasterXML/jackson-databind/pull/5970
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38