Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/06/23 9:24 p.m.12 views

jackson-databind has @JsonView bypass for setterless creator properties

Summary In BeanDeserializer.deserializeUsingPropertyBased, the active-view @JsonView filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInViewactiveView check. A change making SetterlessProperty.isMerging return true routed setterless...

5.3CVSS5.8AI score0.00297EPSS
SaveExploits0References7Affected Software2
Rows per page
Query Builder