CVE-2026-54516: jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields
Summary POJOPropertiesCollector.renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFERPROPERTYMUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter.
Impact POJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.
Affected / Patched (verified via git tag --contains) - 2.21 line: >= 2.21.0, < 2.21.4 -> fixed in 2.21.4 (backport c3d56dd, #5968) - 3.x line: >= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5967, e88cb17)
Severity / CWE Maintainer: minor. Reporter: HIGH. CWE-915.
Credits Omkhar Arasaratnam (@omkhar) - finder.
Other sources
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector.renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFERPROPERTYMUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/tools.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 3.1.4 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 3.1.4 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.21.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54516?
The severity of CVE-2026-54516 is medium with a score of 5.3.
How does CVE-2026-54516 affect jackson-databind?
CVE-2026-54516 allows a property with @JsonProperty on the getter and @JsonIgnore on the setter to be incorrectly processed, potentially leading to unintended behavior.
Which versions of jackson-databind are affected by CVE-2026-54516?
CVE-2026-54516 affects jackson-databind versions from 2.21.0 to 2.21.4 and version 3.1.4.
How do I fix CVE-2026-54516?
To fix CVE-2026-54516, upgrade jackson-databind to a version that is not affected, specifically versions later than 2.21.4 and 3.1.4.
Is CVE-2026-54516 a common vulnerability?
CVE-2026-54516 is specific to the jackson-databind library, and while not generally widespread, it can impact applications using affected versions.