Bug 2492016 (CVE-2026-54515) - CVE-2026-54515 jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
Summary: CVE-2026-54515 jackson-databind: jackson-databind: Ignored properties can be ...
Keywords:
Status: NEW
Alias: CVE-2026-54515
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2495192 2495193 2495194 2495195 2495197 2495200 2495201 2495202 2495196 2495198 2495199
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-23 22:02 UTC by OSIDB Bzimport
Modified: 2026-09-22 15:36 UTC (History)
140 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:67603 0 None None None 2026-09-15 14:41:25 UTC
Red Hat Product Errata RHSA-2026:67604 0 None None None 2026-09-15 14:44:44 UTC
Red Hat Product Errata RHSA-2026:70228 0 None None None 2026-09-22 12:56:53 UTC
Red Hat Product Errata RHSA-2026:70229 0 None None None 2026-09-22 13:01:28 UTC
Red Hat Product Errata RHSA-2026:70230 0 None None None 2026-09-22 12:59:19 UTC
Red Hat Product Errata RHSA-2026:70277 0 None None None 2026-09-22 15:36:28 UTC

Description OSIDB Bzimport 2026-06-23 22:02:16 UTC 
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
Comment 2 Jon Orris 2026-09-15 14:41:17 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4.25

Via RHSA-2026:67603 https://access.redhat.com/errata/RHSA-2026:67603
Comment 3 Jon Orris 2026-09-15 14:44:36 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9

Via RHSA-2026:67604 https://access.redhat.com/errata/RHSA-2026:67604
Comment 4 Jon Orris 2026-09-22 12:56:46 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

Via RHSA-2026:70228 https://access.redhat.com/errata/RHSA-2026:70228
Comment 5 Jon Orris 2026-09-22 12:59:12 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10

Via RHSA-2026:70230 https://access.redhat.com/errata/RHSA-2026:70230
Comment 6 Jon Orris 2026-09-22 13:01:21 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

Via RHSA-2026:70229 https://access.redhat.com/errata/RHSA-2026:70229
Comment 7 Jon Orris 2026-09-22 15:36:20 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1

Via RHSA-2026:70277 https://access.redhat.com/errata/RHSA-2026:70277
Note You need to log in before you can comment on or make changes to this bug.