tools.jackson.core:jackson-databind 3.1.3

Direct Vulnerabilities

Known vulnerabilities in the tools.jackson.core:jackson-databind package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improperly Controlled Modification of Dynamically-Determined Object Attributes Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the `BeanDeserializerBase.createContextual()` method, which applies the per-property exclusions through `_handleByNameInclusion()` and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via `@JsonFormat` with `ACCEPT_CASE_INSENSITIVE_PROPERTIES` alongside per-property `@JsonIgnoreProperties`. How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes? A fix was pushed into the `master` branch but not yet published.	[0,)
M Improperly Controlled Modification of Dynamically-Determined Object Attributes Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods, which rename rather than drop a property whose getter carries `@JsonProperty` and whose setter carries `@JsonIgnore`, leaving the private backing field writable. An attacker can write a field that was meant to be unsettable, enabling property tampering and mass assignment, by supplying the renamed JSON key during deserialization, because the factory observes `hasField()==true` and builds a writable `FieldProperty` for the backing field. Exploitation requires `MapperFeature.INFER_PROPERTY_MUTATORS` to be enabled, which is the default, and a target type that pairs a renamed getter with an ignored setter, and the impact is limited to writing existing fields with no path to remote code execution. How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes? Upgrade `tools.jackson.core:jackson-databind` to version 3.1.4 or higher.	[,3.1.4)
C Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the `DatabindContext._resolveAndValidateGeneric()` method, which validates only the raw container class of a type identifier against the configured `PolymorphicTypeValidator` and not its nested generic type arguments. An attacker who controls the type identifier can instantiate a denied class, and reach unauthenticated remote code execution through an available gadget, by embedding that class as a generic parameter of an allowlisted container such as `java.util.ArrayList<com.evil.Gadget>`, which passes validation while the nested type is loaded, instantiated, and populated with attacker-controlled values. Exploitation requires polymorphic type validation to be enabled with a configured validator, the application to deserialize untrusted JSON, and a suitable gadget class on the classpath. How to fix Deserialization of Untrusted Data? Upgrade `tools.jackson.core:jackson-databind` to version 3.1.4 or higher.	[,3.1.4)
C Incomplete List of Disallowed Inputs Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` method, which allowlists an array based only on `clazz.isArray()` and does not validate the array's component type. An attacker who controls the deserialized JSON can instantiate types outside the configured allowlist by wrapping them in an array, because array elements without per-element type identifiers are constructed directly with no further validator check. How to fix Incomplete List of Disallowed Inputs? Upgrade `tools.jackson.core:jackson-databind` to version 3.1.4 or higher.	[,3.1.4)
M Incorrect Authorization Affected versions of this package are vulnerable to Incorrect Authorization in the `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method, which replays buffered JSON into creator parameters without consulting `prop.visibleInView(activeView)`. An attacker can set view-restricted constructor parameters annotated with both `@JsonView` and `@JsonUnwrapped`, such as admin-only fields, from untrusted JSON by supplying them during deserialization while a more restrictive view is active, defeating the `@JsonView` write-side authorization boundary. How to fix Incorrect Authorization? Upgrade `tools.jackson.core:jackson-databind` to version 3.1.4 or higher.	[,3.1.4)
M Incorrect Authorization Affected versions of this package are vulnerable to Incorrect Authorization in the `BeanDeserializer._deserializeUsingPropertyBased` method, whose property-buffering branch omits the `prop.visibleInView(activeView)` check that the creator-property branch performs. An attacker can populate view-restricted setterless collection or map properties, such as admin-only fields, from untrusted JSON by supplying values for them during deserialization, bypassing `@JsonView` protection. This affects only setterless collection or map properties annotated with a restricted `@JsonView` and reached through the property-based creator path. How to fix Incorrect Authorization? Upgrade `tools.jackson.core:jackson-databind` to version 3.1.4 or higher.	[,3.1.4)
M Server-side Request Forgery (SSRF) Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the `JDKFromStringDeserializer` class, which constructs `InetSocketAddress` and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups for chosen hostnames by submitting JSON that is deserialized into a type holding an `InetSocketAddress` field, with no authentication required. The observable effect is limited to DNS resolution of attacker-chosen names, useful for out-of-band interaction or internal resolver probing rather than a full outbound request, and it applies only where the application deserializes untrusted JSON into types containing such fields. How to fix Server-side Request Forgery (SSRF)? Upgrade `tools.jackson.core:jackson-databind` to version 3.1.4 or higher.	[,3.1.4)

Vulnerability

Vulnerable Version

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.

How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes?

A fix was pushed into the master branch but not yet published.

[0,)

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._renameProperties() and BeanDeserializerFactory.addBeanProps() methods, which rename rather than drop a property whose getter carries @JsonProperty and whose setter carries @JsonIgnore, leaving the private backing field writable. An attacker can write a field that was meant to be unsettable, enabling property tampering and mass assignment, by supplying the renamed JSON key during deserialization, because the factory observes hasField()==true and builds a writable FieldProperty for the backing field. Exploitation requires MapperFeature.INFER_PROPERTY_MUTATORS to be enabled, which is the default, and a target type that pairs a renamed getter with an ignored setter, and the impact is limited to writing existing fields with no path to remote code execution.

How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes?