Bug 2492016 (CVE-2026-54515)

Summary:	CVE-2026-54515 jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aakkiang, aazores, abrianik, alinfoot, anthomas, ant, anujha, aschwart, asoldano, asyoung, aszczucz, ataylor, avibelli, bbaranow, bbrownin, bgeorges, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, cfu, chfoley, cmah, dandread, dbruscin, dfreiber, dhanak, dkreling, dlofthou, drichtar, drosa, drow, dschmidt, dsimansk, dtrifiro, eaguilar, ebaron, edewata, ehelms, ehugonne, ewittman, fmariani, fmongiar, ggainey, ggrzybek, gkimetto, gmalinko, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jhollowa, jkoehler, jlanda, jmagne, jmartisk, jmatsuok, jnethert, jolong, jpasqual, jpechane, jraez, jtolenti, juwatts, jwon, kaycoth, kgaikwad, kingland, kshier, kvanderr, lphiri, lthon, manderse, mcarlett, mdellweg, mfargett, mhulan, mnovotny, mosmerov, mposolda, msvehla, nipatil, nmoumoul, nwallace, olubyans, osousa, pantinor, parichar, pberan, pcreech, pdelbell, pesilva, pgallagh, pjindal, pmackay, prichard, prisingh, probinso, rbryant, rchan, rgodfrey, rguimara, rhel-process-autobot, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, sdawley, simaishi, skhandel, smallamp, snegrini, ssilvert, stcannon, sthirugn, sthorger, swoodman, taherrin, tasato, tcunning, teagle, thjenkin, tmalecek, tqvarnst, vdosoudi, vkumar, vmuzikar, watson-tool-maintainers, weaton, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly ignored properties. This could lead to unintended changes in application data, impacting data integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2495192, 2495193, 2495194, 2495195, 2495197, 2495200, 2495201, 2495202, 2495196, 2495198, 2495199
Bug Blocks:

Description OSIDB Bzimport 2026-06-23 22:02:16 UTC

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

Comment 2 Jon Orris 2026-09-15 14:41:17 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4.25

Via RHSA-2026:67603 https://access.redhat.com/errata/RHSA-2026:67603

Comment 3 Jon Orris 2026-09-15 14:44:36 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9

Via RHSA-2026:67604 https://access.redhat.com/errata/RHSA-2026:67604

Comment 4 Jon Orris 2026-09-22 12:56:46 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

Via RHSA-2026:70228 https://access.redhat.com/errata/RHSA-2026:70228

Comment 5 Jon Orris 2026-09-22 12:59:12 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10

Via RHSA-2026:70230 https://access.redhat.com/errata/RHSA-2026:70230

Comment 6 Jon Orris 2026-09-22 13:01:21 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

Via RHSA-2026:70229 https://access.redhat.com/errata/RHSA-2026:70229

Comment 7 Jon Orris 2026-09-22 15:36:20 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1

Via RHSA-2026:70277 https://access.redhat.com/errata/RHSA-2026:70277