CVE-2026-54516

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.

• CWE-915

• https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250aPatch
• https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074afPatch
• https://github.com/FasterXML/jackson-databind/pull/5967Issue Tracking, Patch
• https://github.com/FasterXML/jackson-databind/pull/5968Issue Tracking, Patch
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55Vendor Advisory

Published

Jun 23, 2026

Last Modified

Jun 27, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54502Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-5451The Extensions for Leaflet Map plugin for WordPress is vulne…6.4
• CVE-2026-54512jackson-databind contains the general-purpose data-binding f…8.1
• CVE-2026-54513jackson-databind contains the general-purpose data-binding f…8.1
• CVE-2026-54514jackson-databind contains the general-purpose data-binding f…5.3
• CVE-2026-54515jackson-databind contains the general-purpose data-binding f…5.3
• CVE-2026-54517jackson-databind contains the general-purpose data-binding f…5.3
• CVE-2026-54518jackson-databind contains the general-purpose data-binding f…6.5
• CVE-2026-5452A flaw has been found in UCC CampusConnect App up to 14.3.5 …3.3
• CVE-2026-54522MessagePack for Ruby is an implementation of the MessagePack…5.4
• CVE-2026-54526Argo Workflows is an open source container-native workflow e…9.9
• CVE-2026-54527JupyterLab Git is a Git extension for JupyterLab. From 0.30.…9