Threat Advisory

Jackson-databind JsonView Vulnerabilities Affect Creators

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in the jackson-databind library across various versions of the 2.x and 3.x release lines. These issues encompass Incorrect Authorization, Server-Side Request Forgery (SSRF), and Denial of Service (DoS). Successful exploitation of these flaws could allow attackers to bypass critical security controls to perform mass-assignment or privilege escalation, trigger unauthorized outbound DNS requests for internal network scanning, or cause application instability and crashes via resource exhaustion.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in the jackson-databind library across various versions of the 2.x and 3.x release lines. These issues encompass Incorrect Authorization, Server-Side Request Forgery (SSRF), and Denial of Service (DoS). Successful exploitation of these flaws could allow attackers to bypass critical security controls to perform mass-assignment or privilege escalation, trigger unauthorized outbound DNS requests for internal network scanning, or cause application instability and crashes via resource exhaustion.[emaillocker id="1283"]

  • CVE-2026-59889 with a CVSS score of 6.5 – This vulnerability permits an attacker to bypass @JsonView restrictions on @JsonUnwrapped properties, allowing mass-assignment or privilege escalation by writing to properties that should be protected by less-privileged active views.
    • CVE-2026-54518 with a CVSS score of 6.5 – An attacker can exploit this flaw to bypass @JsonView restrictions on unwrapped creator parameters, enabling unauthorized modification of view-restricted fields during deserialization.
    • CVE-2026-50193 with a CVSS score of 7.5 – This vulnerability allows an attacker to trigger a Denial of Service condition by sending deeply nested JSON data that causes a StackOverflowError when the application attempts to serialize the node using toString().
    • CVE-2026-54517 with a CVSS score of 5.3 – This issue allows an attacker to bypass @JsonView restrictions on setterless collection or map properties, resulting in unauthorized data modification through mass-assignment.
    • CVE-2026-54514 with a CVSS score of 5.3 – This vulnerability enables Server-Side Request Forgery (SSRF) by forcing eager DNS resolution during the deserialization of InetSocketAddress fields, allowing attackers to probe internal networks.

The presence of these vulnerabilities poses a significant risk to data integrity and system availability, particularly for applications relying on Jackson for input validation and access control. Organizations face potential business disruptions from service outages and severe security incidents resulting from privilege escalation or unauthorized internal network access. Immediate attention is required to assess exposure and prevent exploitation of these authorization and logic flaws.

RECOMMENDATION:

  • We recommend you to update jackson-databind to version 3.2.1.

REFERENCES:

The following reports contain further technical details:
https://github.com/advisories/GHSA-5gvw-p9qm-jgwh
https://github.com/advisories/GHSA-rcqc-6cw3-h962
https://github.com/advisories/GHSA-3wrr-7qpf-2prh
https://github.com/advisories/GHSA-5hh8-q8hv-fr38
https://github.com/advisories/GHSA-hgj6-7826-r7m5

[/emaillocker]
crossmenu