CVE-2026-54515 Security Details

CVE ID

CVE-2026-54515

CWE

CWE-915

CVE Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

Published

Jun 16, 2026

CVSS Score & Severity

6.9Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.373%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/fasterxml/jackson/databind/deser/BeanDeserializerBase.createContextual(Lcom/fasterxml/jackson/databind/DeserializationContext;Lcom/fasterxml/jackson/databind/BeanProperty;)Lcom/fasterxml/jackson/databind/JsonDeserializer;

JVMVulnerable params: 0

tools/jackson/databind/deser/bean/BeanDeserializerBase.createContextual(Ltools/jackson/databind/DeserializationContext;Ltools/jackson/databind/BeanProperty;)Ltools/jackson/databind/ValueDeserializer;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

fedoraproject.orgPROJECT

GitHub · FasterXML/jackson-databindPROJECT