CVE-2026-54516

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3

Description An issue exists in the POJOPropertiesCollector. renameProperties() function where a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter is renamed instead of dropped. When MapperFeature.INFER PROPERTY MUTATORS is enabled, the private backing field is retained. During deserialization, BeanDeserializerFactory.addBeanProps() identifies that hasField() is true, creates a FieldProperty, and makes the backing field writable. This allows an attacker to provide a renamed JSON key to write to the backing field directly, bypassing the @JsonIgnore restriction on the setter, leading to property tampering or mass assignment.

Recommendations Update to version 2.21.4 for the 2.21 line. Update to version 3.1.4 for the 3.x line.