🛡️ CVE-2026-54518 on Debian — jackson-databind
Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.
Distribution advisory
This page covers CVE-2026-54518 as tracked by Debian, for the package jackson-databind. No fixed version has been recorded for this distribution yet.
How this vulnerability can be exploited
This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity low, availability none.
Weakness class
DEBIAN-CVE-2026-54518 is classified as CWE-863: Incorrect Authorization. An authorisation check runs but reaches the wrong conclusion, permitting actions it should refuse.
Affected software
DEBIAN-CVE-2026-54518 is recorded against 1 package.
- jackson-databind
Timeline and source
Published on 23 June 2026 and last revised on 4 August 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
Details
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| jackson-databind | — | — |
References
Similar Threats
- Unknown ALSA-2026:43218
- Unknown DEBIAN-CVE-2026-50193
- High CVE-2026-50193
- High CVE-2026-54512
- High CVE-2026-54513
Vulnerability Monitoring
Track new vulnerabilities in jackson-databind
DEBIAN-CVE-2026-54518 is rated CVSS 6.5 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.
Set Up Free Alerts →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.