CVE-2026-54515

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.8.0 through 2.18.8 jackson-databind versions 2.21.0 through 2.21.4 jackson-databind versions 3.0.0 through 3.1.3

Description In the createContextual() function of BeanDeserializerBase, per-property @JsonIgnoreProperties exclusions are applied by handleByNameInclusion(), which creates a contextual deserializer with ignored properties removed from its BeanPropertyMap. However, when the per-property case-insensitivity block is triggered by @JsonFormat(ACCEPT CASE INSENSITIVE PROPERTIES), it rebuilds using the original unfiltered this. beanProperties map instead of the filtered contextual. beanProperties. This process overwrites the filtered map and restores the ignored properties, making them writable again. This can lead to a mass-assignment-style write where fields intended to be unwritable can be set using untrusted JSON if case-insensitive matching is enabled.

Recommendations Update to version 2.18.9 Update to version 2.21.5 Update to version 3.1.4