What is the CVSS score of CVE-2026-54516?

CVE-2026-54516 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-54516?

Yes, a patch is available for CVE-2026-54516. Update the affected software to the latest version immediately.

jackson-databind CVE-2026-54516

EUVD-2026-38590 MEDIUM

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-06-23 security-advisories@github.com

GHSA-9fxm-vc8v-hj55

Deserialization Red Hat Jackson Databind Fasterxml

5.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable via JSON endpoint, no privileges required, limited integrity impact only; no confidentiality or availability consequence per advisory.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 23, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 23, 2026 - 21:35 vuln.today

Analysis Generated

Jun 23, 2026 - 21:35 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5,224 maven packages depend on com.fasterxml.jackson.core:jackson-databind (1,712 direct, 3,569 indirect)
376 maven packages depend on tools.jackson.core:jackson-databind (106 direct, 270 indirect)

Ecosystem-wide dependent count for version 2.21.0 and other introduced versions.

DescriptionCVE.org

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.

AnalysisAI

Integrity bypass in jackson-databind 2.21.0-2.21.3 and 3.0.0-3.1.3 allows unauthenticated network attackers to write to private backing fields that application developers intended as read-only. The flaw occurs when a POJO uses @JsonProperty on a getter with @JsonIgnore on the setter - a common read-only-over-the-wire pattern - and MapperFeature.INFER_PROPERTY_MUTATORS is enabled (the default). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The GHSA advisory characterizes the impact as property tampering and mass assignment; maintainers rate it minor despite a reporter-assessed HIGH severity.

Technical ContextAI

jackson-databind (Maven coordinates com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind for the 3.x line) is the core data-binding layer of the widely used Jackson JSON processor for Java/JVM. The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly called mass assignment. The logic error is in POJOPropertiesCollector._renameProperties(): when a getter carries @JsonProperty('renamed') and its paired setter carries @JsonIgnore, the renaming step should drop the property from deserialization eligibility entirely. Instead, because couldDeserialize() returns false only on the setter, the private backing field remains eligible via MapperFeature.INFER_PROPERTY_MUTATORS (enabled by default since Jackson 2.x). BeanDeserializerFactory.addBeanProps() subsequently detects hasField()==true, constructs a FieldProperty for that private field, and registers it as writable. The fix - adding prop.removeFields() in _renameProperties() for properties whose renamed-but-ignored setter left an inferred field mutator - was applied in commits c3d56dd (2.21.4 backport, PR #5968) and e88cb17 (3.1.4, PR #5967).

RemediationAI

Upgrade jackson-databind to 2.21.4 (for the 2.21.x line) or 3.1.4 (for the 3.x line), as confirmed by GHSA-9fxm-vc8v-hj55 and the upstream commit history (commits c3d56dd and e88cb17). Maven coordinates are com.fasterxml.jackson.core:jackson-databind:2.21.4 and com.fasterxml.jackson.core:jackson-databind:3.1.4 respectively. If patching immediately is not feasible, the most targeted compensating control is to explicitly disable MapperFeature.INFER_PROPERTY_MUTATORS on ObjectMapper instances (mapper.disable(MapperFeature.INFER_PROPERTY_MUTATORS)); note that this may alter deserialization behavior for other POJOs relying on inferred field mutators and should be tested for regressions. Alternatively, replace the @JsonProperty-on-getter plus @JsonIgnore-on-setter pattern with @JsonProperty(access = JsonProperty.Access.READ_ONLY) on the getter, which takes a different code path not affected by this bug. Input filtering at the API boundary for the renamed JSON key provides defense-in-depth but is brittle and not a reliable primary control. The advisory and fix PRs are at https://github.com/FasterXML/jackson-databind/pull/5967 and https://github.com/FasterXML/jackson-databind/pull/5968.