Incorrect Authorization Affecting com.fasterxml.jackson.core:jackson-databind package, versions [2.18.0,2.18.9)[2.21.0,2.21.5)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-COMFASTERXMLJACKSONCORE-18170132
- published22 Jul 2026
- disclosed21 Jul 2026
- creditUnknown
Introduced: 21 Jul 2026
New CVE NOT AVAILABLE CWE-863 (opens in a new tab)How to fix?
Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5 or higher.
Overview
com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
Affected versions of this package are vulnerable to Incorrect Authorization in the deserializeUsingPropertyBasedWithExternalTypeId file. An attacker can populate restricted creator properties from untrusted input by crafting JSON that exploits the lack of view checks on parameters annotated with both @JsonView and @JsonTypeInfo(include=As.EXTERNAL_PROPERTY). This allows unauthorized assignment of sensitive fields, even when a restrictive view is active, by injecting values through polymorphic type information.