Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/07/21 10:0 p.m.13 views

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

Summary UnwrappedPropertyHandler.processUnwrapped replays the buffered JSON for a @JsonUnwrapped property by iterating its properties and calling prop.deserializeAndSet with no prop.visibleInViewctxt.getActiveView guard — the exact guard processUnwrappedCreatorProperties received in the 5971 /...

6.5CVSS5.7AI score0.00346EPSS
SaveExploits0References6Affected Software2
Rows per page
Query Builder