CVE-2026-54516 Details
Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.
A vulnerability in Jackson Databind versions 2.21.0 prior to 2.21.4 and 3.0.0 prior to 3.1.4 allows for property tampering. The issue arises in the POJOPropertiesCollector._renameProperties() method, where a property with @JsonProperty on the getter and @JsonIgnore on the setter can be renamed instead of dropped. With the default MapperFeature.INFER_PROPERTY_MUTATORS setting, the private backing field remains accessible. During deserialization, this allows an attacker to write directly to the backing field, circumventing the @JsonIgnore annotation on the setter.
Users can upgrade to Jackson Databind version 2.21.4 or 3.1.4, both of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fasterxml jackson-databind | >= 2.21.0, < 2.21.4 >= 3.0.0, < 3.1.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 27, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |