Bug 2491996 (CVE-2026-54516) - CVE-2026-54516 jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties
Summary: CVE-2026-54516 jackson-databind: jackson-databind: Security bypass due to imp...
Keywords:
Status: NEW
Alias: CVE-2026-54516
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2495343 2495347 2495349 2495353 2495358 2495360 2495363 2495366 2495369 2495371 2495373
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-23 22:01 UTC by OSIDB Bzimport
Modified: 2026-07-03 16:12 UTC (History)
137 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-23 22:01:15 UTC 
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.
Note You need to log in before you can comment on or make changes to this bug.