Skip to main content

jackson-databind CVE-2026-54515

| EUVDEUVD-2026-38591 MEDIUM
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)
2026-06-23 security-advisories@github.com GHSA-5jmj-h7xm-6q6v
Information Disclosure Red Hat Jackson Databind Fasterxml
5.3
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
5.3 MEDIUM

Network-delivered JSON triggers bypass without credentials; integrity-only impact limited to per-property field write, no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch available
Jun 23, 2026 - 22:02 EUVD
Source Code Evidence Fetched
Jun 23, 2026 - 21:35 vuln.today
Analysis Generated
Jun 23, 2026 - 21:35 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 3,169 maven packages depend on tools.jackson.core:jackson-databind (837 direct, 2,334 indirect)

Ecosystem-wide dependent count for version 3.1.0.

DescriptionCVE.org

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map - restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

AnalysisAI

Per-property @JsonIgnoreProperties filtering in jackson-databind is silently bypassed when the same property also carries @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES), enabling unauthenticated network attackers (per CVSS AV:N/PR:N) to write to fields the application explicitly excluded from deserialization. The flaw spans versions from 2.8.0 through the 2.18.x, 2.19-2.21.x, and 3.1.x release lines and constitutes a mass-assignment integrity risk wherever ignored fields guard sensitive state such as privilege or role attributes. No public exploit tool or CISA KEV listing has been identified at time of analysis; vendor-released patches (2.18.9, 2.21.5, 3.1.4) were published 2026-06-04.

Technical ContextAI

jackson-databind (Maven artifact com.fasterxml.jackson.core:jackson-databind) is the dominant JSON serialization and deserialization library in the Java ecosystem, underpinning Spring Boot, Micronaut, Quarkus, and the broader Jackson Data Processor. The root cause class is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), colloquially mass assignment. In BeanDeserializerBase.createContextual(), two contextual annotation features interact destructively: _handleByNameInclusion() correctly filters a BeanPropertyMap to honor per-property @JsonIgnoreProperties, producing a contextual deserializer with the named properties removed. However, the immediately following case-insensitivity block - triggered only when @JsonFormat(with = JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES) is present on the same property - reads this._beanProperties (the original, unfiltered instance field on the base deserializer) rather than contextual._beanProperties (the just-filtered copy). withCaseInsensitivity() rebuilds the map from the unfiltered source, and contextual.withBeanProperties(props) then overwrites the filtered map with the restored, unfiltered one. The one-line upstream fix (commit 0e1b0b2) changes the variable sourced for the rebuild from _beanProperties to contextual._beanProperties, ensuring the filtered state is preserved through the case-insensitive rebuild.

RemediationAI

The primary remediation is to upgrade jackson-databind to 2.18.9, 2.21.5, or 3.1.4 as appropriate for the release line in use; for the 3.x tools.jackson.core group ID, upgrade to 3.1.4. These versions incorporate commit 0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa. Full advisory and package coordinates are at https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v. If immediate upgrade is blocked, the most targeted workaround is to remove @JsonFormat(with = JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES) from any property that simultaneously carries @JsonIgnoreProperties, since the vulnerability requires both annotations together - removing either annotation breaks the exploit path; trade-off is loss of case-insensitive matching for that property. A second workaround is to migrate security-critical field exclusions from per-property @JsonIgnoreProperties to class-level @JsonIgnoreProperties or @JsonIgnoreType, which are applied through a different code path not subject to this bug; trade-off is broader exclusion scope than may be intended. Enabling case-insensitive matching at the ObjectMapper level via MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES (rather than per-property @JsonFormat) is not confirmed to trigger the same code path and may be a viable interim alternative, though this has not been independently verified against the patch.

More in Jackson Databind

View all
CVE-2020-11113 HIGH
8.8 Mar 31

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9548 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35728 HIGH
8.1 Dec 27

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35491 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9547 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35490 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-36183 HIGH POC
8.1 Jan 07

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2022-42004 HIGH POC
7.5 Oct 02

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeseriali
CVE-2022-42003 HIGH POC
7.5 Oct 02

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of
CVE-2019-12086 HIGH POC
7.5 May 17

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. Rated high severity (CVSS 7.5)
CVE-2020-25649 HIGH
7.5 Dec 03

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
CVE-2026-59889 MEDIUM POC
6.5 Jul 14

jackson-databind's @JsonView authorization guard is bypassable on deserialization when a property carries both @JsonView

Same weakness CWE-915 – Improperly Controlled Modification of Dynamically-Determined Object Attributes

View all
CVE-2026-50160 CRITICAL POC
10.0
CVE-2026-33453 CRITICAL POC
10.0
CVE-2024-5452 CRITICAL POC
9.8
CVE-2022-31106 CRITICAL POC
9.8
CVE-2026-72710 CRITICAL POC
9.3
CVE-2021-21368 HIGH POC
8.8
CVE-2026-42044 CRITICAL POC
9.1
CVE-2024-0404 CRITICAL POC
9.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-54515 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy