CVE-2026-54515
Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
How to fix
- fasterxml jackson-databind2.18.9, 2.21.5, 3.1.4 or later
- com.fasterxml.jackson.core:jackson-databind3.1.4, 2.18.9, 2.21.5, 2.22.1 or later
- tools.jackson.core:jackson-databind3.1.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | 2.8.0 ≤ v < 2.18.9, 2.19.0 ≤ v < 2.21.5, 3.0.0 ≤ v < 3.1.4, 2.22.0 | 2.18.9, 2.21.5, 3.1.4 |
| com.fasterxml.jackson.core:jackson-databindMaven | 3.1.0 ≤ v < 3.1.4, 2.8.0 ≤ v < 2.18.9, 2.19.0 ≤ v < 2.21.5, 2.22.0 ≤ v < 2.22.1 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 |
| tools.jackson.core:jackson-databindMaven | 3.1.0 ≤ v < 3.1.4 | 3.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.