CVE Feed

    Dashboard / CVE / CVE-2026-54515

    CVE-2026-54515

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

    Published:Jun 23, 2026
    Last Modified:Jun 24, 2026
    EPS:Jun 23, 2026
    EPSS Score:0.0035
    CVSS Score:5.3

    Affected Products

    Vendor
    Fasterxml
    Product
    Jackson-databind

    Exploits

    https://github.com/xiaoqiMikko/jackson-check

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-83557 (CVSS 5.6) — DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo …
    CVE-2026-19032 (CVSS 5.3) — jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting t…
    CVE-2026-77310 (CVSS 5.3) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-59889 (CVSS 6.5) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-59888 (CVSS 6.5) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-54518 (CVSS 6.5) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-50193 (CVSS 6.3) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-54512 (CVSS 8.1) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-54513 (CVSS 8.1) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-54514 (CVSS 5.3) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High